[BUG] general protection fault in su3000_i2c_transfer

[BUG] general protection fault in su3000_i2c_transfer

[Xianying Wang]

Hi media maintainers/developers,,

I am reporting a general protection fault in the DVB USB dw2102 driver
that is reproducible on Linux 7.2-rc3.

The reproducer connects a crafted USB DVB device through dummy_hcd and
then issues an I2C_RDWR ioctl through the i2c-dev interface. The I2C
message passed to the adapter has no data buffer / invalid length, but it
still reaches the su3000_i2c_transfer() callback.

The crash happens when su3000_i2c_transfer() dereferences the I2C message
buffer without first validating that the message has a valid buffer and a
sufficient length:

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: su3000_i2c_transfer+0x549/0xdb0

The relevant call trace is:

  su3000_i2c_transfer
  __i2c_transfer
  i2c_transfer
  i2cdev_ioctl_rdwr
  i2cdev_ioctl
  __x64_sys_ioctl
  do_syscall_64

The syzkaller reproducer sends the following I2C_RDWR request after the
USB device has been created:

  ioctl$I2C_RDWR(fd, I2C_RDWR, {
      msgs = [{ addr = 0x1a00, flags = 0x9211, len = 0, buf = NULL }],
      nmsgs = 1
  })

This looks similar to the existing syzbot report for
su3000_i2c_transfer(), but I wanted to provide a fresh reproduction on the
current kernel I tested:

  Kernel version: 7.2.0-rc3
  HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809

Full console log, syzkaller reproducer, and kernel config are attached
below.
HEAD commit:
1137d8b5df06137fb49513cc923b3b24d94cb809
report: https://pastebin.com/raw/YT3zKcrX
console output :https://pastebin.com/raw/UE2E67ws
kernel config : https://pastebin.com/raw/k2Vq1fKj

Thanks for taking a look.