[BUG] media: s2255: vmalloc out-of-bounds read in s2255_fwload_start()

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/147-media-s2255-fwload-vmalloc-oob/

  s2255: usb firmware version 0.0
  s2255: newer USB firmware available
  BUG: KASAN: vmalloc-out-of-bounds in s2255_fwload_start+0x1a6/0x410
  Read of size 512 at addr ffffc9000010e000 by task kworker/0:1/10
  Workqueue: usb_hub_wq hub_event
  Call Trace:
   __asan_memcpy+0x29/0x70
   s2255_fwload_start+0x1a6/0x410
   s2255_probe+0xbd5/0x10a0
   usb_probe_interface+0x659/0xc70
   really_probe+0x267/0xaf0
   __driver_probe_device+0x1e2/0x350
   driver_probe_device+0x4f/0x240
   __device_attach_driver+0x270/0x410
   bus_for_each_drv+0x258/0x2f0
   __device_attach+0x2c5/0x450

This is a different site from commit 330f2936ab76 ("media: s2255: check firmware
size before reading trailing marker"), which guards s2255_probe(); the read
above is the CHUNK_SIZE copy in s2255_fwload_start(), and the crash is from a
tree that already contains that commit.

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,