[BUG] media: dw2102: general protection fault in su3000_i2c_transfer

[BUG] media: dw2102: general protection fault in su3000_i2c_transfer

[CJ]

Hi,


I am reporting a general protection fault in the dw2102 DVB USB driver's I2C
transfer routine, triggered by a syzkaller USB reproducer.  The issue is
reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935
(v7.3-rc1, Linux 7.3.0-rc1).


The reproducer connects a synthetic USB device that matches the dw2102 driver,
opens the I2C device node the driver registers, and issues an I2C_RDWR ioctl
with a two-message transfer.


The console shows a general protection fault for the non-canonical address
0xdffffc0000000002 with a KASAN null-ptr-deref in the range [0x10-0x17], and RIP
in su3000_i2c_transfer.  The path is the I2C device ioctl reaching the driver's
transfer callback, with the null dereference happening on the transfer's private
state.


One possible cause is that the driver registers its I2C adapter before the
device state it uses in the transfer callback has been set up, or leaves the
adapter registered after a failed initialization, so an I2C transfer can arrive
while the private structure is still NULL.  This looks like a lifetime or
ordering problem between adapter registration and device setup rather than a
problem with the I2C message itself.  I am reporting the fault and the path as
observed.


This appears to be a recurrence of the syzbot issue whose external id is
d8a78093d7b0bb080e67.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer:
syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="21010000db168920402000d92ca9010203010902120001000000000904"], 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000001c0)={&(0x7f0000000000)=[{0x1900, 0x0, 0x0, 0x0}, {0x1, 0x0, 0x0, 0x0}], 0x2})


console output: https://pastebin.com/raw/jZkKz3ji
kernel config: https://pastebin.com/raw/6gefXKVd


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian