Forwarded: [PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64

[syzbot <syzbot+f408eac9faa61d5a1927@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] media: dw2102: fix OOB read on firmware size not a multiple of 64
Author: vasilisalmpanis@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 848acc8ffe1b

diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 4fecf2f965e9..4e26e1776977 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -1902,9 +1902,11 @@ static int dw2102_load_firmware(struct usb_device *dev,
 	if (p) {
 		memcpy(p, fw->data, fw->size);
 		for (i = 0; i < fw->size; i += 0x40) {
+			int len = min_t(size_t, fw->size - i, 0x40);
+
 			b = (u8 *)p + i;
-			if (dw210x_op_rw(dev, 0xa0, i, 0, b, 0x40,
-					 DW210X_WRITE_MSG) != 0x40) {
+			if (dw210x_op_rw(dev, 0xa0, i, 0, b, len,
+					 DW210X_WRITE_MSG) != len) {
 				err("error while transferring firmware");
 				ret = -EINVAL;
 				break;
-- 
2.47.3