From patchwork Mon Apr 21 16:33:01 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnaud Lecomte X-Patchwork-Id: 882941 Received: from plesk.hostmyservers.fr (plesk.hostmyservers.fr [45.145.164.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 629661AF0AF; Mon, 21 Apr 2025 16:33:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.145.164.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745253191; cv=none; b=WGplFTM4rRE3kkiP2ZLXtL3z2J2VfIKdL7AAgVwftQG7RIGQbC6Mcgtul/WhIEse4IUyE54FqvFSQG8D9zyB6y06f3VUu8mUD+xW/zS20+BgYp2+lUo2p31hE6r9nlpgSuO3tc+CTiJELFypytVPsMePutAYqv+oJWnwFS488tw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745253191; c=relaxed/simple; bh=2l2AqMqZOxpwFutfqvrhIda6aBkA7YBQ2JfUuCTrwjE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Di2QrJZyNqqLZvzwB6fNv2XBv+ye2DAWD1pMmxA1ntzkNvffRWPc4YIIUqzyQUVmTXKVtTL00h1THmfU/15HTx3q5G0uyh/hFK0uFd1lvCFFYIWnhfjrfG9tw7g8M6si1eajN2M422+hwxaQMgwC+XqFQGqZ0dcrcu0OvafZHPk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=arnaud-lcm.com; spf=pass smtp.mailfrom=arnaud-lcm.com; arc=none smtp.client-ip=45.145.164.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=arnaud-lcm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arnaud-lcm.com Received: from [127.0.1.1] (unknown [IPv6:2a01:e0a:3e8:c0d0:8e8c:c49a:b330:a587]) by plesk.hostmyservers.fr (Postfix) with ESMTPSA id B525440C039; Mon, 21 Apr 2025 16:33:07 +0000 (UTC) Authentication-Results: Plesk; spf=pass (sender IP is 2a01:e0a:3e8:c0d0:8e8c:c49a:b330:a587) smtp.mailfrom=contact@arnaud-lcm.com smtp.helo=[127.0.1.1] Received-SPF: pass (Plesk: connection is authenticated) From: Arnaud Lecomte Date: Mon, 21 Apr 2025 18:33:01 +0200 Subject: [PATCH 1/2] media: dvb-usbv2: add bound checking for messages length in i2c_xfer Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20250421-ubsan-out-of-sub-v1-1-d9239a5af007@arnaud-lcm.com> References: <20250421-ubsan-out-of-sub-v1-0-d9239a5af007@arnaud-lcm.com> In-Reply-To: <20250421-ubsan-out-of-sub-v1-0-d9239a5af007@arnaud-lcm.com> To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+0192952caa411a3be209@syzkaller.appspotmail.com, contact@arnaud-lcm.com, skhan@linuxfoundation.org X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1745253187; l=1937; i=contact@arnaud-lcm.com; s=20250405; h=from:subject:message-id; bh=2l2AqMqZOxpwFutfqvrhIda6aBkA7YBQ2JfUuCTrwjE=; b=PwUASeQaSzSpJ3RtdDleX2ClZLoV4o8tCZjUgJ8fAUar8BbSN6dfwXspDu9cy5GcXx467Mhr4 KU+o8ITNWGHB3YOv/lf1FSzhnoK4UDf5WHOe3zffC5/MQ9Ca7YD0Ffc X-Developer-Key: i=contact@arnaud-lcm.com; a=ed25519; pk=Ct5pwYkf/5qSRyUpocKOdGc2XBlQoMYODwgtlFsDk7o= X-PPP-Message-ID: <174525318807.30871.1729452319038199590@Plesk> X-PPP-Vhost: arnaud-lcm.com I2C messages should not be longer than a couple of hundred bytes. However, despite this very unlikely scenario, it can happen and in this case, this could lead to a buffer overflow in i2c_xfer. Signed-off-by: Arnaud Lecomte --- drivers/media/usb/dvb-usb-v2/az6007.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c index 65ef045b74ca..e8ee18010346 100644 --- a/drivers/media/usb/dvb-usb-v2/az6007.c +++ b/drivers/media/usb/dvb-usb-v2/az6007.c @@ -757,6 +757,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], for (i = 0; i < num; i++) { addr = msgs[i].addr << 1; + if (msgs[i].len < 1 || msgs[i].len >= sizeof(st->data) - 6) { + ret = -EIO; + goto err; + } if (((i + 1) < num) && (msgs[i].len == 1) && ((msgs[i].flags & I2C_M_RD) != I2C_M_RD) @@ -788,10 +792,6 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n", addr, msgs[i].len); - if (msgs[i].len < 1) { - ret = -EIO; - goto err; - } req = AZ6007_I2C_WR; index = msgs[i].buf[0]; value = addr | (1 << 8); @@ -806,10 +806,6 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n", addr, msgs[i].len); - if (msgs[i].len < 1) { - ret = -EIO; - goto err; - } req = AZ6007_I2C_RD; index = msgs[i].buf[0]; value = addr; @@ -825,7 +821,6 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], } err: mutex_unlock(&st->mutex); - if (ret < 0) { pr_info("%s ERROR: %i\n", __func__, ret); return ret; From patchwork Mon Apr 21 16:33:02 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnaud Lecomte X-Patchwork-Id: 883360 Received: from plesk.hostmyservers.fr (plesk.hostmyservers.fr [45.145.164.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2CCA11C84AB; Mon, 21 Apr 2025 16:33:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.145.164.37 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745253193; cv=none; b=DNo6fJpWyX6JvfXhKfYO7Q5BlE1WfLrR9eQXfj4VB4D3vEp1/YLFCfSU4ACD7+gmsb0PV6sDoxAKQPjC2/rdHHki16MxzEfjLbDqY5VvouoJdoudMgXjntgs+YJT1csy8KMEz97jL1TStTSrqXaFVrXNk3Urd9zmJ/YIQ3rEtH8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745253193; c=relaxed/simple; bh=ZdxUod+8vHsExl8vnmiNub9FeRAgmNE1AnMkKzlBxOk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=eI3ajHbpxriD3ppPnxuyg1jNNbpZqDsZNu+Ssdt9Fyjd9K7/DLfKe35tAV/+E+jFjPn7iPkVOTKMGo0cqP+4UxesOjcNsBnS2bHy0QCV2sbL3bSIDYdHXntSUG+Zqa4GqOkFMxUHcqo8CrlEhlFZCpjEP31yJOm71cCZdFfvlRs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=arnaud-lcm.com; spf=pass smtp.mailfrom=arnaud-lcm.com; arc=none smtp.client-ip=45.145.164.37 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=arnaud-lcm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arnaud-lcm.com Received: from [127.0.1.1] (unknown [IPv6:2a01:e0a:3e8:c0d0:8e8c:c49a:b330:a587]) by plesk.hostmyservers.fr (Postfix) with ESMTPSA id 2EA4E40760F; Mon, 21 Apr 2025 16:33:08 +0000 (UTC) Authentication-Results: Plesk; spf=pass (sender IP is 2a01:e0a:3e8:c0d0:8e8c:c49a:b330:a587) smtp.mailfrom=contact@arnaud-lcm.com smtp.helo=[127.0.1.1] Received-SPF: pass (Plesk: connection is authenticated) From: Arnaud Lecomte Date: Mon, 21 Apr 2025 18:33:02 +0200 Subject: [PATCH 2/2] media: dvb-usbv2: ensure safe USB transfers on disconnect in i2c_xfer Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20250421-ubsan-out-of-sub-v1-2-d9239a5af007@arnaud-lcm.com> References: <20250421-ubsan-out-of-sub-v1-0-d9239a5af007@arnaud-lcm.com> In-Reply-To: <20250421-ubsan-out-of-sub-v1-0-d9239a5af007@arnaud-lcm.com> To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+0192952caa411a3be209@syzkaller.appspotmail.com, contact@arnaud-lcm.com, skhan@linuxfoundation.org X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1745253187; l=2330; i=contact@arnaud-lcm.com; s=20250405; h=from:subject:message-id; bh=ZdxUod+8vHsExl8vnmiNub9FeRAgmNE1AnMkKzlBxOk=; b=xKOrkUOVP0Q42pSVk2Z4omZafYqR/2FgmzCmItzJ0hX9Coq/kSs7eB9TtDEsQIy5zG04TYnkc IkP/iyzHXVZChe35ewMolBcR/jnlTQLkzvP4B4rlr8ntb2KVvLuf0Cm X-Developer-Key: i=contact@arnaud-lcm.com; a=ed25519; pk=Ct5pwYkf/5qSRyUpocKOdGc2XBlQoMYODwgtlFsDk7o= X-PPP-Message-ID: <174525318857.30884.11376688935051155226@Plesk> X-PPP-Vhost: arnaud-lcm.com Previously, there was a potential race condition where a USB transfer could access inconsistent data if a disconnect occurred mid-transfer. When this scenario happens (i.e when there is an USB disconnect during the transfer), we would encounter an error related to the corruption of st: [ 66.967387][T10787] slab kmalloc-8k start ffff88804f5b4000 pointer offset 80 size 8192 [ 66.968252][T10787] list_del corruption. prev->next should be ffffc9000d18f7e0, but was ffff88804f5b4050. (prev=ffff88804f5b4050) [ 66.969443][T10787] ------------[ cut here ]------------ [ 66.969973][T10787] kernel BUG at lib/list_debug.c:64! [ 66.970491][T10787] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 66.971104][T10787] CPU: 0 UID: 0 PID: 10787 Comm: repro Not tainted 6.15.0-rc3-00004-gcd75cc176092-dirty #28 PREEMPT(full) [ 66.972204][T10787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 66.973236][T10787] RIP: 0010:__list_del_entry_valid_or_report+0x15c/0x190 [ 66.973896][T10787] Code: ca da fb fc 42 80 3c 2b 00 74 08 4c 89 e7 e8 fb 29 1f fd 49 8b 14 24 48 c7 c7 a0 09 a2 8c 4c 89 fe 4c 89 e1 e8 55 43 18 fc 90 <0f> 0b 4c 89 f7 e8 9a da fb fc 42 80 3c 2b 00 74 08 4c 89 e7 e8 cb Signed-off-by: Arnaud Lecomte --- drivers/media/usb/dvb-usb-v2/az6007.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c index e8ee18010346..f6b8e29d19de 100644 --- a/drivers/media/usb/dvb-usb-v2/az6007.c +++ b/drivers/media/usb/dvb-usb-v2/az6007.c @@ -752,8 +752,13 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int length; u8 req, addr; - if (mutex_lock_interruptible(&st->mutex) < 0) + if (!usb_trylock_device(d->udev)) + return -EBUSY; + + if (mutex_lock_interruptible(&st->mutex) < 0) { + usb_unlock_device(d->udev); return -EAGAIN; + } for (i = 0; i < num; i++) { addr = msgs[i].addr << 1; @@ -821,6 +826,7 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], } err: mutex_unlock(&st->mutex); + usb_unlock_device(d->udev); if (ret < 0) { pr_info("%s ERROR: %i\n", __func__, ret); return ret;