a7y18lte-ubports/android_kernel_samsung_a7y18lte
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
430f30553b
android_kernel_samsung_a7y1.../drivers
History
Johan Hovold 430f30553b media: stv06xx: add missing descriptor sanity checks 
commit 485b06aadb933190f4bc44e006076bc27a23f205 upstream.

Make sure to check that we have two alternate settings and at least one
endpoint before accessing the second altsetting structure and
dereferencing the endpoint arrays.

This specifically avoids dereferencing NULL-pointers or corrupting
memory when a device does not have the expected descriptors.

Note that the sanity checks in stv06xx_start() and pb0100_start() are
not redundant as the driver is mixing looking up altsettings by index
and by number, which may not coincide.

Fixes: 8668d504d72c ("V4L/DVB (12082): gspca_stv06xx: Add support for st6422 bridge and sensor")
Fixes: c0b33bdc5b8d ("[media] gspca-stv06xx: support bandwidth changing")
Cc: stable <stable@vger.kernel.org>     # 2.6.31
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-07 14:25:02 +02:00
..
accessibility
acpi x86/mm: split vmalloc_sync_all() 2020-04-07 14:14:34 +02:00
amba
android ANDROID: binder: synchronize_rcu() when using POLLFREE. 2020-04-07 08:06:59 +02:00
ata ahci: Do not export local variable ahci_em_messages 2020-04-07 13:43:01 +02:00
atm atm: eni: fix uninitialized variable warning 2020-04-07 13:45:54 +02:00
auxdisplay
base driver core: Print device when resources present in really_probe() 2020-04-07 13:56:48 +02:00
battery
battery_v2
bcma bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA 2020-04-07 13:43:09 +02:00
block floppy: check FDC index for errors before assigning it 2020-04-07 14:01:14 +02:00
bluetooth Bluetooth: btusb: fix PM leak in error case of setup 2020-04-07 13:24:51 +02:00
bts
bus
ccic
cdrom cdrom: respect device capabilities during opening action 2020-04-07 13:23:35 +02:00
char ipmi:ssif: Handle a possible NULL pointer reference 2020-04-07 14:04:14 +02:00
clk clk: qcom: rcg2: Don't crash if our parent can't be found; return an error 2020-04-07 13:56:02 +02:00
clocksource clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable 2020-04-07 13:40:44 +02:00
connector
cpufreq cpufreq: Register drivers only after CPU devices have been registered 2020-04-07 13:21:35 +02:00
cpuidle cpuidle: Do not unset the driver if it is there already 2020-04-07 13:07:18 +02:00
crypto crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill 2020-04-07 13:50:08 +02:00
dca
devfreq PM / devfreq: Don't fail devfreq_dev_release if not in list 2020-04-07 13:24:09 +02:00
dio
dma dmaengine: coh901318: Fix a double lock bug in dma_tc_handle() 2020-04-07 14:10:45 +02:00
dma-buf
edac EDAC/ghes: Fix grain calculation 2020-04-07 13:21:28 +02:00
eisa
extcon extcon: sm5502: Reset registers during initialization 2020-04-07 13:20:38 +02:00
fingerprint
firewire net: add annotations on hh->hh_len lockless accesses 2020-04-07 13:25:04 +02:00
firmware efi: Add a sanity check to efivar_store_raw() 2020-04-07 14:12:01 +02:00
five
fmc
fpga
gator
gpio gpio: Fix error message on out-of-range GPIO in lookup table 2020-04-07 13:36:46 +02:00
gps
gpu Revert "drm/dp_mst: Skip validating ports during destruction, just ref" 2020-04-07 14:23:22 +02:00
gud
hid HID: hiddev: Fix race in in hiddev_disconnect() 2020-04-07 14:04:49 +02:00
hsi
hv
hwmon hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() 2020-04-07 14:10:44 +02:00
hwspinlock drivers/hwspinlock: use correct radix tree API 2020-04-07 14:23:53 +02:00
hwtracing intel_th: Fix user-visible error codes 2020-04-07 14:14:24 +02:00
i2c i2c: hix5hd2: add missed clk_disable_unprepare in remove 2020-04-07 14:24:07 +02:00
ide ide: serverworks: potential overflow in svwks_set_pio_mode() 2020-04-07 13:56:59 +02:00
idle
iio iio: buffer: align the size of scan bytes to size of the largest element 2020-04-07 13:45:04 +02:00
infiniband IB/ipoib: Do not warn if IPoIB debugfs doesn't exist 2020-04-07 14:23:46 +02:00
input Input: edt-ft5x06 - work around first register access error 2020-04-07 13:56:40 +02:00
iommu iommu/vt-d: Ignore devices with out-of-spec domain number 2020-04-07 14:11:55 +02:00
ipack
irqchip irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL 2020-04-07 13:57:27 +02:00
isdn staging: gigaset: add endpoint-type sanity check 2020-04-07 13:06:29 +02:00
leds leds: leds-lp5562 allow firmware files up to the maximum length 2020-04-07 07:37:48 +02:00
lguest
lightnvm
macintosh macintosh/windfarm_smu_sat: Fix debug output 2020-04-07 12:35:02 +02:00
mailbox
mcb
md dm cache: fix a crash due to incorrect work item cancelling 2020-04-07 14:10:49 +02:00
media media: stv06xx: add missing descriptor sanity checks 2020-04-07 14:25:02 +02:00
memory
memstick memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' 2020-04-07 09:27:02 +02:00
message scsi: mptfusion: Fix double fetch bug in ioctl 2020-04-07 13:37:43 +02:00
mfd mfd: rn5t618: Mark ADC control register volatile 2020-04-07 13:51:00 +02:00
misc altera-stapl: altera_get_note: prevent write beyond end of 'key' 2020-04-07 14:14:00 +02:00
mmc mmc: spi: Toggle SPI polarity, do not hardcode it 2020-04-07 13:49:49 +02:00
motor
mtd mtd: spear_smi: Fix Write Burst mode 2020-04-07 13:06:47 +02:00
muic
net sxgbe: Fix off by one in samsung driver strncpy size arg 2020-04-07 14:24:05 +02:00
nfc NFC: fdp: Fix a signedness bug in fdp_nci_send_patch() 2020-04-07 14:23:32 +02:00
ntb ntb: intel: fix return value for ndev_vec_mask() 2020-04-07 12:36:03 +02:00
nubus
nvdimm
nvme
nvmem nvmem: core: return error code instead of NULL from nvmem_device_get 2020-04-07 12:27:36 +02:00
of of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc 2020-04-07 13:50:01 +02:00
oprofile
parisc parisc: Disable HP HSC-PCI Cards to prevent kernel crash 2020-04-07 07:39:52 +02:00
parport parport: load lowlevel driver if ports not found 2020-04-07 13:21:33 +02:00
pci PCI: Don't disable bridge BARs when assigning bus resources 2020-04-07 13:56:46 +02:00
pcmcia
perf
phy
pinctrl pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs 2020-04-07 13:56:29 +02:00
platform MIPS: Loongson: Fix return value of loongson_hwmon_init 2020-04-07 13:43:51 +02:00
pnp
power power: supply: ltc2941-battery-gauge: fix use-after-free 2020-04-07 13:49:57 +02:00
powercap
pps
ps3
ptp
pwm pwm: Clear chip_data in pwm_put() 2020-04-07 12:43:26 +02:00
rapidio
ras
regulator regulator: rk808: Lower log level on optional GPIOs being not available 2020-04-07 13:56:05 +02:00
remoteproc remoteproc: Initialize rproc_class before use 2020-04-07 13:57:01 +02:00
reset
rpmsg
rtc rtc: max8907: add missing select REGMAP_IRQ 2020-04-07 14:14:26 +02:00
s390 s390/cio: cio_ignore_proc_seq_next should increase position index 2020-04-07 14:10:08 +02:00
sbus
scsi scsi: sd: Fix optimal I/O size for devices that change reported values 2020-04-07 14:24:15 +02:00
security/samsung/icdrv
sensorhub
sensors
sfi
sh
sn
soc soc/tegra: fuse: Correct straps' address for older Tegra124 device trees 2020-04-07 13:56:37 +02:00
spi spi/zynqmp: remove entry that causes a cs glitch 2020-04-07 14:13:54 +02:00
spmi
ssb
staging staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback 2020-04-07 14:24:53 +02:00
switch
target scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session" 2020-04-07 14:03:54 +02:00
tc
tee
thermal thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power 2020-04-07 13:41:59 +02:00
thunderbolt thunderbolt: Use 32-bit writes when writing ring producer/consumer 2020-04-07 09:27:58 +02:00
trace
tty vt: selection, push sel_lock up 2020-04-07 14:10:27 +02:00
uh
uio uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol() 2020-04-07 13:55:48 +02:00
usb usb: musb: fix crash with highmen PIO and usbmon 2020-04-07 14:24:45 +02:00
uwb
vfio vfio_pci: Enable memory accesses before calling pci_map_rom 2020-04-07 13:40:33 +02:00
vhost vhost: Check docket sk_family instead of call getname 2020-04-07 14:23:44 +02:00
video vgacon: Fix a UAF in vgacon_invert_region 2020-04-07 14:10:20 +02:00
virt
virtio virtio-balloon: fix managed page counts when migrating pages between zones 2020-04-07 13:06:49 +02:00
vision
vlynq
vme
w1
watchdog watchdog: da9062: do not ping the hw during stop() 2020-04-07 14:10:06 +02:00
xen xen: Enable interrupts when calling _cond_resched() 2020-04-07 14:04:03 +02:00
zorro
Kconfig
Makefile