Skip to contentSkip to conversation

media: dw2102: fix OOB read on firmware size not a multiple of 64

PATCH In review Vasileios Almpanis 1 participant 3 messages Aug 6 – Sep 2

Subsystems (2)
Stable branch Media (V4L/DVB)
lore
Share & tools
lore

Vasileios Almpanis

author
#0 lore raw

PATCH 1/1 media: dw2102: fix OOB read on firmware size not a multiple of 64

dw2102_load_firmware() copies the firmware into a buffer of exactly fw->size bytes, then walks it in 0x40-byte steps while always passing 0x40 as the transfer length. When fw->size is not a multiple of 64 the last chunk reads past the end of the allocation producing the following splat:

dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
dw2102: start downloading DW210X firmware
==================================================================

  BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
  Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
  Call Trace:
   <TASK>
   kasan_report+0x117/0x150 mm/kasan/report.c:595
   check_region_inline mm/kasan/generic.c:-1 [inline]
   kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
   __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
   dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
   dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906

Fix this by clamping the last chunk to the remaining bytes;

Cc [email protected]
Reported-by [email protected]
Closes https://syzkaller.appspot.com/bug?extid=f408eac9faa61d5a1927
Fixes 7fd4828f6cc5 ("V4L/DVB (8421): Adds support for Dvbworld DVB-S 2102 USB card")
Signed-off-by Vasileios Almpanis <[email protected]>
---
 drivers/media/usb/dvb-usb/dw2102.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/usb/dvb-usb/dw2102.c +4 -2
index 4fecf2f965e9..4e26e1776977 100644
@@ -1902,9 +1902,11 @@ static int dw2102_load_firmware(struct usb_device *dev,
 	if (p) {
 		memcpy(p, fw->data, fw->size);
 		for (i = 0; i < fw->size; i += 0x40) {
+			int len = min_t(size_t, fw->size - i, 0x40);
+
 			b = (u8 *)p + i;
-			if (dw210x_op_rw(dev, 0xa0, i, 0, b, 0x40,
-					 DW210X_WRITE_MSG) != 0x40) {
+			if (dw210x_op_rw(dev, 0xa0, i, 0, b, len,
+					 DW210X_WRITE_MSG) != len) {
 				err("error while transferring firmware");
 				ret = -EINVAL;
 				break;

---
base-commit: fcaeecb8b0cd44f77d03b28de0671258d4db18f8
change-id: 20260806-dvb-307714ff6225

Best regards,

Signature · 1 line
Vasileios Almpanis <[email protected]>
author Tested-by [email protected] on v1 1/1
#1 lore raw
Quoted 20 lines · Vasileios Almpanis

dw2102_load_firmware() copies the firmware into a buffer of exactly fw->size bytes, then walks it in 0x40-byte steps while always passing 0x40 as the transfer length. When fw->size is not a multiple of 64 the last chunk reads past the end of the allocation producing the following splat:

   dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
   dw2102: start downloading DW210X firmware
   ==================================================================
   BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
   Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
   Call Trace:
    <TASK>
    kasan_report+0x117/0x150 mm/kasan/report.c:595
    check_region_inline mm/kasan/generic.c:-1 [inline]
    kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
    __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
    dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
    dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
Quoted 1 line

Fix this by clamping the last chunk to the remaining bytes;

I sent this patch to syzbot for testing and it reported success.
https://syzkaller.appspot.com/bug?extid=f408eac9faa61d5a1927

Tested-by [email protected]
Quoted 36 lines
Cc [email protected]
Reported-by [email protected]
Closes https://syzkaller.appspot.com/bug?extid=f408eac9faa61d5a1927
Fixes 7fd4828f6cc5 ("V4L/DVB (8421): Adds support for Dvbworld DVB-S 2102 USB card")
Signed-off-by Vasileios Almpanis <[email protected]>
---
  drivers/media/usb/dvb-usb/dw2102.c | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/usb/dvb-usb/dw2102.c +4 -3
index 4fecf2f965e9..4e26e1776977 100644
@@ -1902,9 +1902,11 @@ static int dw2102_load_firmware(struct usb_device *dev,
  	if (p) {
  		memcpy(p, fw->data, fw->size);
  		for (i = 0; i < fw->size; i += 0x40) {
+			int len = min_t(size_t, fw->size - i, 0x40);
+
  			b = (u8 *)p + i;
-			if (dw210x_op_rw(dev, 0xa0, i, 0, b, 0x40,
-					 DW210X_WRITE_MSG) != 0x40) {
+			if (dw210x_op_rw(dev, 0xa0, i, 0, b, len,
+					 DW210X_WRITE_MSG) != len) {
  				err("error while transferring firmware");
  				ret = -EINVAL;
  				break;
 
---

base-commit: fcaeecb8b0cd44f77d03b28de0671258d4db18f8
change-id: 20260806-dvb-307714ff6225

Best regards,
--
Vasileios Almpanis <[email protected]>

author
#2 lore raw
In reply to Vasileios Almpanis
Quoted 20 lines

dw2102_load_firmware() copies the firmware into a buffer of exactly fw->size bytes, then walks it in 0x40-byte steps while always passing 0x40 as the transfer length. When fw->size is not a multiple of 64 the last chunk reads past the end of the allocation producing the following splat:

dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
dw2102: start downloading DW210X firmware
==================================================================

  BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
  Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
  Call Trace:
   <TASK>
   kasan_report+0x117/0x150 mm/kasan/report.c:595
   check_region_inline mm/kasan/generic.c:-1 [inline]
   kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
   __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
   dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
   dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
Quoted 2 lines

Fix this by clamping the last chunk to the remaining bytes;

Hello everyone!

A gentle ping on this patch. Is there something you would like me to change or is the patch good to go?

Kind regards,

Signature · 1 line
Vasileios Almpanis <[email protected]>