[PATCH] media: dvb-frontends: tda665x: fix stack overflow in get_status()

[Guo Zihao]

tda665x_get_status() declares a single-byte stack variable and passes
its address to tda665x_read():

        u8 result = 0;
        err = tda665x_read(state, &result);

tda665x_read() builds an i2c_msg with .len = 2 and .buf = &result, so
the I2C transfer writes two bytes into a one-byte buffer: the second
byte, controlled by the tuner's response, lands on whatever follows
result on the kernel stack.  The get_status callback runs on every
FE_READ_STATUS ioctl, which frontends typically poll in a tight loop.

Verified with a userspace copy of the two functions under
AddressSanitizer: the 2-byte write into the 1-byte buffer reports
"stack-buffer-overflow WRITE of size 2".

Make the buffer two bytes wide and test the lock bit on the first
byte, matching the register layout of the driver.  The buffer is
zero-initialized so the unused second byte stays well defined.

Fixes: 3e978a828408 ("V4L/DVB (13797): [Mantis/Hopper/TDA665x] Large overhaul,")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
 drivers/media/dvb-frontends/tda665x.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/dvb-frontends/tda665x.c b/drivers/media/dvb-frontends/tda665x.c
index b2201ec14..7b876c16a 100644
--- a/drivers/media/dvb-frontends/tda665x.c
+++ b/drivers/media/dvb-frontends/tda665x.c
@@ -66,16 +66,16 @@ static int tda665x_get_frequency(struct dvb_frontend *fe, u32 *frequency)
 static int tda665x_get_status(struct dvb_frontend *fe, u32 *status)
 {
 	struct tda665x_state *state = fe->tuner_priv;
-	u8 result = 0;
+	u8 result[2] = { 0 };
 	int err = 0;
 
 	*status = 0;
 
-	err = tda665x_read(state, &result);
+	err = tda665x_read(state, result);
 	if (err < 0)
 		goto exit;
 
-	if ((result >> 6) & 0x01) {
+	if ((result[0] >> 6) & 0x01) {
 		printk(KERN_DEBUG "%s: Tuner Phase Locked\n", __func__);
 		*status = 1;
 	}
-- 
2.50.1