Commit e2498602 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Gu Bowen
Browse files

media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init 

stable inclusion
from stable-v4.19.247
commit a3660e06675bccec4bf149c7229ea1d491ba10d7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VC
CVE: CVE-2022-49478

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a3660e06675bccec4bf149c7229ea1d491ba10d7



--------------------------------

[ Upstream commit 471bec68 ]

Syzbot reported that -1 is used as array index. The problem was in
missing validation check.

hdw->unit_number is initialized with -1 and then if init table walk fails
this value remains unchanged. Since code blindly uses this member for
array indexing adding sanity check is the easiest fix for that.

hdw->workpoll initialization moved upper to prevent warning in
__flush_work.

Reported-and-tested-by: default avatar <syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com>

Fixes: d855497e ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarGu Bowen <gubowen5@huawei.com>
parent afadf562

drivers/media/usb/pvrusb2/pvrusb2-hdw.c

+5 −2
Original line number Diff line number Diff line
@@ -2561,6 +2561,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, 
	} while (0);

	mutex_unlock(&pvr2_unit_mtx);



	INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll);



	if (hdw->unit_number == -1)

		goto fail;



	cnt1 = 0;

	cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2");

	cnt1 += cnt2;
@@ -2572,8 +2577,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, 
	if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1;

	hdw->name[cnt1] = 0;



	INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll);



	pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s",

		   hdw->unit_number,hdw->name);