]> git.ipfire.org Git - thirdparty/linux.git/commit
media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc
authorEdward Adam Davis <eadavis@qq.com>
Mon, 3 Nov 2025 11:57:49 +0000 (19:57 +0800)
committerHans Verkuil <hverkuil+cisco@kernel.org>
Tue, 4 Nov 2025 12:31:02 +0000 (13:31 +0100)
commit1a31cb2782104969e48c7ce7e4fc06e403fcb5cf
tree45a77d1b7407b718f10518d9e75555f5b7d7b634
parent2d71d7b5e95120c7f922f2836846d6a0d9c36b11
media: dvb-usb: pctv452e: move snd/rcv len check before kmalloc

syzbot reported a uninit-value in pctv452e_i2c_msg. [1]

When the snd_len or rcv_len check fails and jumps to failed, buf is
uninitialized, triggering the uninit-value issue.

Move the snd/rcv length check before kmalloc, and return -EINVAL directly
if the condition is met.

[1]
BUG: KMSAN: uninit-value in hex_string+0x681/0x740 lib/vsprintf.c:1220
 pctv452e_i2c_msg+0x82a/0x8f0 drivers/media/usb/dvb-usb/pctv452e.c:467
 pctv452e_i2c_xfer+0x2e6/0x4c0 drivers/media/usb/dvb-usb/pctv452e.c:502

Reported-by: syzbot+480edd2cadb85ddb4bbe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=480edd2cadb85ddb4bbe
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
drivers/media/usb/dvb-usb/pctv452e.c