kernel/linux.git/drivers/media/usb/usbvision, branch linux-4.4.y

usbvision: revert commit 588afcc1

2018-11-10T15:41:36+00:00

[ Upstream commit d5468d7afaa9c9e961e150f0455a14a9f4872a98 ] Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces array")' should be reverted, because: * "!dev->actconfig->interface[ifnum]" won't catch a case where the value is not NULL but some garbage. This way the system may crash later with GPF. * "(ifnum >= USB_MAXINTERFACES)" does not cover all the error conditions. "ifnum" should be compared to "dev->actconfig-> desc.bNumInterfaces", i.e. compared to the number of "struct usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES. * There is a "struct usb_device" leak in this error path, as there is usb_get_dev(), but no usb_put_dev() on this path. * There is a bug of the same type several lines below with number of endpoints. The code is accessing hard-coded second endpoint ("interface->endpoint[1].desc") which may not exist. It would be great to handle this in the same patch too. * All the concerns above are resolved by already-accepted commit fa52bd50 ("[media] usbvision: fix crash on detecting device with invalid configuration") * Mailing list message: http://www.spinics.net/lists/linux-media/msg94832.html Signed-off-by: Vladis Dronov Signed-off-by: Hans Verkuil Cc: # for v4.5 Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

usbvision fix overflow of interfaces array

2018-01-17T08:35:27+00:00

commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream. This fixes the crash reported in: http://seclists.org/bugtraq/2015/Oct/35 The interface number needs a sanity check. Signed-off-by: Oliver Neukum Cc: Vladis Dronov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

usbvision: fix NULL-deref at probe

2017-05-25T12:30:12+00:00

commit eacb975b48272f54532b62f515a3cf7eefa35123 upstream. Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer or accessing memory beyond the endpoint array should a malicious device lack the expected endpoints. Fixes: 2a9f8b5d25be ("V4L/DVB (5206): Usbvision: set alternate interface modification") Cc: Thierry MERLE Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

usbvision: fix crash on detecting device with invalid configuration

2016-04-20T06:42:17+00:00

commit fa52bd506f274b7619955917abfde355e3d19ffe upstream. The usbvision driver crashes when a specially crafted usb device with invalid number of interfaces or endpoints is detected. This fix adds checks that the device has proper configuration expected by the driver. Reported-by: Ralf Spenneberg Signed-off-by: Vladis Dronov Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman

[media] usbvision: move init code to probe()

2015-08-11T09:55:26+00:00

These things are only initialized if you start streaming video, but they are also used in the disconnect function. So just init them always during probe time. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] usbvision: fix standards for S-Video/Composite inputs

2015-08-11T09:55:00+00:00

The standards supported by S-Video and Composite inputs are not limited by PAL, so make it more generic. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] usbvision: fix DMA from stack warnings

2015-08-11T09:54:22+00:00

In various places the stack was used to provide buffers for USB data, but this should be allocated memory. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] usbvision: fix locking error

2015-08-11T09:53:21+00:00

If remove_pending is non-zero, then the v4l2_lock is never unlocked. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] usbvision: set field and colorspace

2015-08-11T09:53:01+00:00

Set the colorspace and field in vidioc_try_fmt_vid_cap(). Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] usbvision: frequency fixes

2015-08-11T09:52:31+00:00

- setup initial radio and tv frequencies. - set/get the correct frequency (radio vs tv). - disable tuner/freq ioctls if there is no tuner. - fix some tuner index checks. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab