From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A481748BD48 for ; Wed, 1 Jul 2026 12:36:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782909407; cv=none; b=JYwr2BrnSGmTfskVnVgGExaHMY5RYjHTeJkAYYXN3sMohEXzeHVm/QY+IAGsIJDlWBhPq2lKfX8918nwYr3IV3R8DAT7VMCU4PDybN1FUEU0bCn1X1x0Cm/vOd+qVPMy0w3+1UynyRjVH3KV0h39H/yhQJFw/Gt1+U3IjwH0UQI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782909407; c=relaxed/simple; bh=qxvk4YJQ6XSShJzJ2XbQlAWBWrG98CnV0/FfhF1YheQ=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=A2+NDsELV0aOdi31rX0GSOhZh+XjOA4R1VxU2BzxFCxOBCLhkFZSyhJdyJ+YU3H/04Zo8o5xB+yELXDmqvteOv4zCY1gRBVhwqIFstVpH5edc3Uhe+00Wke62IjsgYC0EByAesEoRmXlgIPs+kUFseTLdYJKA+4gMLQqPYERGM4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=c1s43w+g; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="c1s43w+g" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-37fc01a7835so312827a91.3 for ; Wed, 01 Jul 2026 05:36:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782909406; x=1783514206; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=kRZ5y6jv3qLE+/HG/vpjw07aIlvGDyFsle/4yejj/PA=; b=c1s43w+g5xhF0FHIxMlSJUPrquox7PYjpd3KhWbLR2onLUKv4t+uYRjRMbYzgGnweS Qe345rejr+A6SZxojFw7TEdy824RdCx3G1m3plGwAFA78LdO9DnUl1EfIKH4+a3P7CeD 58qPudyxTj4VcDxahzzSbrugdUZvLLSQBDoBF3KePISrn2SbOx0H9QolwZY7/17PlM7L YG5W4AHcGRgd/crDnjbGV5kNLWSi+VoE/nQjpcI+U85oDXWY4rMPDVtr8EIe+0Ionw9t WeSgfgHWSw2uOyx5FvUGHyjgShK0rbGLg5fg37u0dwER7mvcRrKY4H9UUEiBZ+F6LR5b LVaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782909406; x=1783514206; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=kRZ5y6jv3qLE+/HG/vpjw07aIlvGDyFsle/4yejj/PA=; b=hqsC7ZWsCXP+0I3OPeNsX+co4D0DccAAoyS0SEErcwGR3kQ8hM1ddAu+WdPDqMgdWW R6cc4woiL9VKz8vuhENYWJipLkwPIU1ON76Y7o8R+eszrFw92ApLNzQ5LCIHpmb+DwXV fo+kCt2Sn6gXfwXSWgaDndJyG4Y6l7Xktj8w43oqI6k0sYb8gGI6tnQ4cb/hINSuTnPC sHNS+dxC/6fxwMMCAkTMVSypXhfrh2n9yfBBrqYaE0IDVX8QMZS03nQk76Q0uO8/Ef+T UHgNUualPl38aj9AxG8DSp+m1Ablx3J8FXp2LVYCwWMWDZe4zric/85a+FPGSBloKmF/ kwrg== X-Forwarded-Encrypted: i=1; AFNElJ96M98VY1GuaJ4gsaTJSQcTtFhkfTWSC9lpP9VTSdjxo4IB1otgqpnx75VNqcuotB9337Px7ca1Q6VQ85w=@vger.kernel.org X-Gm-Message-State: AOJu0Yxmk6ALlcaglr0w80zO+Il3cpeywoRL5qfp5fmVJvjG6tbRoHFZ 8xV+fN6HdJfVHFA24/nQIMkc4MPhUT5gfOCKkjyNP6Qm0V42WFwhAmsp X-Gm-Gg: AfdE7cl/6wFcA5SjynCzNZwAjJb0d5X8XLGNZB3KCq6ufoezN+cDhr80Or5Gxq/po4z ZJV9uUT/DZlAKGBwATeClVb+i/IxYeCPXMOMQG4lSAszau5i9KzIV+ADNgaBIn9TLA260hENDSr 8gwGo8tzEbo7XO3yeEc51yk+08dC24xaiv/XxSyA4wUaYkXcWo/VOO1S3T8PgtnnL04HJGoP67j HLUiVoR3vQjA4kzYAt2QYZa1JkbYRrF5lup4bTsjryz18eh8zBax/3Z593FzgntvVbZH1ePbxDM 5NYPXBYhNwkl2s6d8UUjZalNjeftXqbh11XR+WvFR0OxpFWwXWcm/68CKipwswrBpkM3ME4OzxI 6dLib7gxSHSNMEmLA/eHXKzaGtbQNPpSRNln6hJZ7pMvCgz4n/xQd3hs1rpay9Fb6RCubH9Cosl 2TUAkc5NTPmiAEpC9JTiVWzNuT9x59m3B0OYc+cw== X-Received: by 2002:a05:6300:670a:b0:3bf:6c07:b2ed with SMTP id adf61e73a8af0-3bff42dc827mr598754637.48.1782909405833; Wed, 01 Jul 2026 05:36:45 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c9bbf95be56sm3025872a12.16.2026.07.01.05.36.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 05:36:45 -0700 (PDT) From: Maoyi Xie To: Jasmin Jessich Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: cxd2099: bound the CAM reply length in read_data Date: Wed, 1 Jul 2026 20:36:41 +0800 Message-Id: <20260701123641.1674982-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit read_data() drains the CAM FIFO into ci->rbuf with a length the CAM controls: len = ((u16)msb << 8) | lsb; if (len > ecount || len < 2) { /* read it anyway or cxd may hang */ read_block(ci, 0x12, ci->rbuf, len); msb and lsb come from two CAM registers, so len can be as large as 65535. ci->rbuf is u8 rbuf[1028], and wbuf[1028] follows it as the last member of struct cxd. read_block() advances the destination pointer for each chunk it reads, and it never checks the buffer size. A len above 1028 runs past rbuf into wbuf, then off the end of the struct. The drain branch runs whenever len is larger than ecount, and the caller caps ecount at 512. A CAM length from 1029 to 65535 writes up to about 63KB past the buffer. This only happens with buffermode=1, which is not the default. A faulty CAM reaches the path the same as a malicious one. Three sibling frontends already guard this. s5h1420, stb0899 and tda10071 bound the device length to the destination before they copy. read_data() now clamps len to sizeof(ci->rbuf) before the drain read. The FIFO still drains and the write stays in bounds. Fixes: 2748e76ddb29 ("media: staging: cxd2099: Activate cxd2099 buffer mode") Cc: stable@vger.kernel.org Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie --- I do not have the hardware. The out-of-bounds write was shown with a small harness that models the rbuf and wbuf tail, not on a real device. drivers/media/dvb-frontends/cxd2099.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/dvb-frontends/cxd2099.c b/drivers/media/dvb-frontends/cxd2099.c index f95950a613..67b2ac4464 100644 --- a/drivers/media/dvb-frontends/cxd2099.c +++ b/drivers/media/dvb-frontends/cxd2099.c @@ -560,6 +560,8 @@ static int read_data(struct dvb_ca_en50221 *ca, int slot, u8 *ebuf, int ecount) len = ((u16)msb << 8) | lsb; if (len > ecount || len < 2) { /* read it anyway or cxd may hang */ + if (len > sizeof(ci->rbuf)) + len = sizeof(ci->rbuf); read_block(ci, 0x12, ci->rbuf, len); mutex_unlock(&ci->lock); return -EIO; -- 2.34.1