linux-kernel - [PATCH] media: dvb: qt1010, change i2c read buffer from stack, to kernel space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 7 Oct 2021 14:29:00 +0200
From:   rkardell <rkardell@...a.se>
To:     linux-media@...r.kernel.org
Cc:     Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] media: dvb: qt1010, change i2c read buffer from stack, to
 kernel space

Solve problem with initialization of Mega Sky 580 USB DVB (and other 
using mt352), error when reading i2c id.


Signed-off-by: rkl099 <rkardell@...a.se>
---
  drivers/media/tuners/qt1010.c | 6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
index 3853a3d43..1bc0756f7 100644
--- a/drivers/media/tuners/qt1010.c
+++ b/drivers/media/tuners/qt1010.c
@@ -11,18 +11,22 @@
  /* read single register */
  static int qt1010_readreg(struct qt1010_priv *priv, u8 reg, u8 *val)
  {
+    u8 *b1=kmalloc(1,GFP_KERNEL);
         struct i2c_msg msg[2] = {
                 { .addr = priv->cfg->i2c_address,
                   .flags = 0, .buf = &reg, .len = 1 },
                 { .addr = priv->cfg->i2c_address,
-                 .flags = I2C_M_RD, .buf = val, .len = 1 },
+                 .flags = I2C_M_RD, .buf = b1, .len = 1 },
         };

         if (i2c_transfer(priv->i2c, msg, 2) != 2) {
                 dev_warn(&priv->i2c->dev, "%s: i2c rd failed reg=%02x\n",
                                 KBUILD_MODNAME, reg);
+           kfree(b1);
                 return -EREMOTEIO;
         }
+       *val=b1[0];
+       kfree(b1);
         return 0;
  }

-- 
2.30.2