CVE-2022-50272

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-usb: az6027: fix null-ptr-deref in az6027i2cxfer()

Wei Chen reports a kernel bug as blew:

general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2ctransfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2ctransfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdevioctlrdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdevioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:870 [inline] __sesysioctl+0xfb/0x170 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0x90 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded

In az6027i2cxfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null.

Fix this by checking msg[i].len in az6027i2cxfer().