linux-kernel - Re: [PATCH v3] media: dvb-usb-v2: disallow 0-length I2C reads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <67ad28ff-ac6c-4a77-a507-465824312825@fintech.ru>
Date: Mon, 9 Jun 2025 13:38:56 +0300
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Wolfram Sang <wsa+renesas@...g-engineering.com>, Mauro Carvalho Chehab
	<mchehab@...nel.org>, <linux-media@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>,
	<syzbot+721071c10f3c7e4e5dcb@...kaller.appspotmail.com>,
	<lvc-project@...uxtesting.org>, Alan Stern <stern@...land.harvard.edu>,
	<gregkh@...uxfoundation.org>
Subject: Re: [PATCH v3] media: dvb-usb-v2: disallow 0-length I2C reads



On 5/21/25 16:36, Wolfram Sang wrote:
> On Wed, May 21, 2025 at 04:17:49PM +0300, Nikita Zhandarovich wrote:
>> Syzkaller reported via syzbot a warning (see [1]) that occurs
>> when the fuzzer manages to craft a I2C transfer with a 0-length read
>> request. This in turn leads to an attempt at execution of a
>> USB 0-length read (which is forbidden by USB protocol) leading to
>> it being interpreted as a write.
>>
>> Enable I2C_AQ_NO_ZERO_LEN_READ adapter quirk for all devices
>> managed by dvb-usb-v2 thus forbidding 0-length read messages
>> altogether.
>>
>> [1] Syzbot report
>> usb 2-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
>> WARNING: CPU: 0 PID: 5845 at drivers/usb/core/urb.c:413 usb_submit_urb+0x11dd/0x18c0 drivers/usb/core/urb.c:411
>> ...
>> Call Trace:
>>  <TASK>
>>  usb_start_wait_urb+0x11a/0x530 drivers/usb/core/message.c:59
>>  usb_internal_control_msg drivers/usb/core/message.c:103 [inline]
>>  usb_control_msg+0x2b3/0x4c0 drivers/usb/core/message.c:154
>>  gl861_ctrl_msg+0x332/0x6f0 drivers/media/usb/dvb-usb-v2/gl861.c:58
>>  gl861_i2c_master_xfer+0x3b4/0x650 drivers/media/usb/dvb-usb-v2/gl861.c:144
>>  __i2c_transfer+0x859/0x2250 drivers/i2c/i2c-core-base.c:-1
>>  i2c_transfer+0x2c2/0x430 drivers/i2c/i2c-core-base.c:2315
>>  i2cdev_ioctl_rdwr+0x488/0x780 drivers/i2c/i2c-dev.c:306
>>  i2cdev_ioctl+0x78a/0xa20 drivers/i2c/i2c-dev.c:467
>>  vfs_ioctl fs/ioctl.c:51 [inline]
>>  __do_sys_ioctl fs/ioctl.c:906 [inline]
>>  __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:892
>>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>>  do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
>>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>> ...
>>
>> Reported-by: syzbot+721071c10f3c7e4e5dcb@...kaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=721071c10f3c7e4e5dcb
>> Tested-by: syzbot+721071c10f3c7e4e5dcb@...kaller.appspotmail.com
>> Fixes: 776338e121b9 ("[PATCH] dvb: Add generalized dvb-usb driver")
>> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
> 
> Reviewed-by: Wolfram Sang <wsa+renesas@...g-engineering.com>
> 

Gentle ping...