Re: [PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64

[Vasileios Almpanis]

> dw2102_load_firmware() copies the firmware into a buffer of exactly
> fw->size bytes, then walks it in 0x40-byte steps while always passing
> 0x40 as the transfer length. When fw->size is not a multiple of 64 the
> last chunk reads past the end of the allocation producing the following
> splat:
> 
>   dvb-usb: downloading firmware from file 'dvb-usb-dw3101.fw'
>   dw2102: start downloading DW210X firmware
>   ==================================================================
>   BUG: KASAN: slab-out-of-bounds in dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
>   Read of size 64 at addr ffff88802bcf2ba0 by task kworker/1:2/803
>   Call Trace:
>    <TASK>
>    kasan_report+0x117/0x150 mm/kasan/report.c:595
>    check_region_inline mm/kasan/generic.c:-1 [inline]
>    kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
>    __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
>    dw210x_op_rw+0xb6/0x180 drivers/media/usb/dvb-usb/dw2102.c:102
>    dw2102_load_firmware+0x2b4/0x970 drivers/media/usb/dvb-usb/dw2102.c:1906
> 
> Fix this by clamping the last chunk to the remaining bytes;
> 
Hello everyone!

A gentle ping on this patch. Is there something you would
like me to change or is the patch good to go?

Kind regards,

-- 
Vasileios Almpanis <vasilisalmpanis@xxxxxxxxx>