[BUG] sd_init (gspca ov534_9) -- strlen(NULL) null-ptr-deref during probe

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/141-gspca-ov534_9-strlen-null-sd_init/

  gspca_main: ov534_9-2.14.0 probing 05a9:8065
  Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:strlen+0x29/0x70
  Workqueue: usb_hub_wq hub_event
  Call Trace:
   strlen+0x29/0x70
   sd_init+0x1dda/0x2e10
   gspca_dev_probe2+0x855/0x1440
   usb_probe_interface+0x659/0xc70
   really_probe+0x267/0xaf0
   __driver_probe_device+0x1e2/0x350
   driver_probe_device+0x4f/0x240
   __device_attach_driver+0x270/0x410
   bus_for_each_drv+0x258/0x2f0
   __device_attach+0x2c5/0x450
  Kernel panic - not syncing: Fatal exception

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,