media: lgdt3306a: Add a check against null-pointer-def
mainline inclusion from mainline-v6.10-rc1 commit c1115ddbda9c930fba0fdd062e7a8873ebaf898d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AEA CVE: CVE-2022-48772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c1115ddbda9c930fba0fdd062e7a8873ebaf898d -------------------------------- The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90 Link: https://lore.kernel.org/linux-media/20220405095018.3993578-1-zheyuma97@gmail.com Signed-off-by:Zheyu Ma <zheyuma97@gmail.com> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org> Fixes: 4f751890 ("[media] lgdt3306a: support i2c mux for use by em28xx") Conflicts: drivers/media/dvb-frontends/lgdt3306a.c [This is because we did not backport commit 2c4746cf ("media: dvb-frontends: Use kmemdup instead of duplicating its function")] Signed-off-by:
Tengda Wu <wutengda2@huawei.com>
Loading
Please sign in to comment