diff options
| author | Edward Adam Davis <eadavis@qq.com> | 2025-11-03 19:57:49 +0800 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2025-11-04 13:31:02 +0100 |
| commit | 1a31cb2782104969e48c7ce7e4fc06e403fcb5cf (patch) | |
| tree | 45a77d1b7407b718f10518d9e75555f5b7d7b634 /drivers/media/platform/qcom/iris/iris_utils.c | |
| parent | 2d71d7b5e95120c7f922f2836846d6a0d9c36b11 (diff) | |
media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc
syzbot reported a uninit-value in pctv452e_i2c_msg. [1]
When the snd_len or rcv_len check fails and jumps to failed, buf is
uninitialized, triggering the uninit-value issue.
Move the snd/rcv length check before kmalloc, and return -EINVAL directly
if the condition is met.
[1]
BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220
pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467
pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502
Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Diffstat (limited to 'drivers/media/platform/qcom/iris/iris_utils.c')
0 files changed, 0 insertions, 0 deletions