[BUG] media: cx231xx: NULL-deref in cx231xx_audio_init() -- actconfig->interface[] indexed without a bounds check

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/144-media-cx231xx-audio-init-null-uif/

  cx231xx 5-1:1.1: Registered video device video0 [v4l2]
  cx231xx 5-1:1.1: Registered VBI device vbi0
  Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:cx231xx_audio_init+0x48a/0xcd0
  Call Trace:
   cx231xx_audio_init+0x48a/0xcd0
   cx231xx_init_extension+0x6c/0xc0 drivers/media/usb/cx231xx/cx231xx-core.c:120
   cx231xx_init_dev drivers/media/usb/cx231xx/cx231xx-cards.c:1504 [inline]
   cx231xx_usb_probe+0x10dd/0x2140
drivers/media/usb/cx231xx/cx231xx-cards.c:1819
   usb_probe_interface+0x657/0xc70 drivers/usb/core/driver.c:396
   really_probe+0x267/0xaf0 drivers/base/dd.c:709
   __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871
   driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
   __driver_attach+0x346/0x640 drivers/base/dd.c:1295

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,