linux-kernel - Is this a bug between dvb_usb_adapter_frontend_init and cinergyt2_frontend

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 24 May 2021 23:06:11 +0800
From:   慕冬亮 <mudongliangabcd@...il.com>
To:     mchehab@...nel.org
Cc:     linux-media@...r.kernel.org,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Is this a bug between dvb_usb_adapter_frontend_init and cinergyt2_frontend_attach?

Hi kernel developers,

I doubt there is a bug between dvb_usb_adapter_frontend_init [1] and
cinergyt2_frontend_attach [2]. The following source code includes the
critical part.

-----------------------------------------------------------------------------------------------------
int dvb_usb_adapter_frontend_init(struct dvb_usb_adapter *adap)
{
        ......
        /* register all given adapter frontends */
        for (i = 0; i < adap->props.num_frontends; i++) {
                ret = adap->props.fe[i].frontend_attach(adap);
                if (ret || adap->fe_adap[i].fe == NULL) {
                        return 0;
                }
        }
        ......
}

static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)
{
        ......
        adap->fe_adap[0].fe = cinergyt2_fe_attach(adap->dev);
        ......
        return ret;
}
-----------------------------------------------------------------------------------------------------

In the dvb_usb_adapter_frontend_init, the function pointer -
frontend_attach points to cinergyt2_frontend_attach. Then the parent
function dvb_usb_adapter_frontend_init checks the return value and
adap->fe_adap[i].fe to verify the execution of the child function.
However, the child function - cinergyt2_frontend_attach passes the
allocated dvb_frontend with adap->fe_adap[0].fe, but the check is
performed on adap->fe_adap[i].fe. At the same time, the adap in both
expressions should be the same data pointer.

Please correct me if you have any opinions with the above statements.

[1] dvb_usb_adapter_frontend_init:
https://elixir.bootlin.com/linux/latest/source/drivers/media/usb/dvb-usb/dvb-usb-dvb.c#L276

[2] cinergyt2_frontend_attach:
https://elixir.bootlin.com/linux/latest/source/drivers/media/usb/dvb-usb/cinergyT2-core.c#L68

--
My best regards to you.

     No System Is Safe!
     Dongliang Mu