[PATCH] media: dvb-frontends: si21xx: validate fec_inner before coderates[] lookup

[PATCH] media: dvb-frontends: si21xx: validate fec_inner before coderates[] lookup

[Guo Zihao]

si21xx_setacquire() indexes the 10-element coderates[] array with the
crate argument, which comes from the user-controlled DTV_INNER_FEC
property.  dvb_frontend_check_parameters() only validates frequency
and symbol_rate, so the value reaches the array lookup unchecked:

        coderate_ptr = coderates[crate];

The enum fe_code_rate range however goes well beyond the table: the
uapi header defines values up to FEC_11_15 = 18, so even a perfectly
legal code rate request such as FEC_9_10 (11), set through the
DTV_INNER_FEC property or a legacy FE_SET_FRONTEND ioctl, indexes
past the end of the array, and arbitrary u32 values overflow it
outright.  The byte read out of bounds is then programmed into the
VIT_SRCH_CTRL_REG_1 register.

Verified with a userspace copy of the function under AddressSanitizer:
crate = 12 (FEC_11_15) reports "stack-buffer-overflow READ of size 1
... 'coderates'".

Reject code rates beyond the table so the Viterbi search is only fed
defined values.

Fixes: 04ad28c9916d ("V4L/DVB (9017): Add support for Silicon Laboratories SI2109/2110 demodulators.")
Cc: stable@vger.kernel.org
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
 drivers/media/dvb-frontends/si21xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/dvb-frontends/si21xx.c b/drivers/media/dvb-frontends/si21xx.c
index e64ced2d6..67d644b7a 100644
--- a/drivers/media/dvb-frontends/si21xx.c
+++ b/drivers/media/dvb-frontends/si21xx.c
@@ -651,6 +651,9 @@ static int si21xx_setacquire(struct dvb_frontend *fe, int symbrate,
 	dprintk("%s\n", __func__);
 
 	status = PASS;
+	if (crate < FEC_NONE || crate > FEC_AUTO)
+		return -EINVAL;
+
 	coderate_ptr = coderates[crate];
 
 	si21xx_set_symbolrate(fe, symbrate);
-- 
2.50.1