Forwarded: [PATCH] media: dvb-usb-v2: fix NULL pointer dereference in dvb_usb_start_feed

[syzbot <syzbot+ac020fbb657e00356ca2@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] media: dvb-usb-v2: fix NULL pointer dereference in dvb_usb_start_feed
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


dvb_usb_start_feed() only checks that adap->active_fe is not -1 before
calling streaming_ctrl() with adap->fe[adap->active_fe]. If the frontend
was detached and adap->fe[active_fe] is NULL while active_fe still holds
a stale index, a NULL frontend is passed to the driver. For gl861
this crashes in friio_streaming_ctrl() when it evaluates fe_to_adap(fe).

Check that adap->fe[adap->active_fe] is not NULL and return -EINVAL
otherwise.

Reported-by: syzbot+ac020fbb657e00356ca2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ac020fbb657e00356ca2
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..eabf020431c8 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -254,7 +254,7 @@ static int dvb_usb_start_feed(struct dvb_demux_feed *dvbdmxfeed)
 	/* wait init is done */
 	wait_on_bit(&adap->state_bits, ADAP_INIT, TASK_UNINTERRUPTIBLE);
 
-	if (adap->active_fe == -1)
+	if (adap->active_fe == -1 || !adap->fe[adap->active_fe])
 		return -EINVAL;
 
 	/* skip feed setup if we are already feeding */
-- 
2.43.0