mirror of
https://github.com/torvalds/linux.git
synced 2024-12-06 19:11:31 +00:00
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
Syzbot reported that -1 is used as array index. The problem was in
missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails
this value remains unchanged. Since code blindly uses this member for
array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in
__flush_work.
Reported-and-tested-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com
Fixes: d855497edb
("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
This commit is contained in:
parent
6b124062d5
commit
471bec6845
@ -2569,6 +2569,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
|
||||
} while (0);
|
||||
mutex_unlock(&pvr2_unit_mtx);
|
||||
|
||||
INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll);
|
||||
|
||||
if (hdw->unit_number == -1)
|
||||
goto fail;
|
||||
|
||||
cnt1 = 0;
|
||||
cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2");
|
||||
cnt1 += cnt2;
|
||||
@ -2580,8 +2585,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
|
||||
if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1;
|
||||
hdw->name[cnt1] = 0;
|
||||
|
||||
INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll);
|
||||
|
||||
pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s",
|
||||
hdw->unit_number,hdw->name);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user