kernel.git/drivers/media/dvb/dvb-core, branch linux-2.6.17.y

dvb-core: Proper handling ULE SNDU length of 0 (CVE-2006-4623)

2006-10-13T18:50:09Z

ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation code has a bug that allows an attacker to send a malformed ULE packet with SNDU length of 0 and bring down the receiving machine. This patch fix the bug and has been tested on version 2.6.17.11. This bug is 100% reproducible and the modified source code (GPL) used to produce this bug will be posted on http://nrg.cs.usm.my/downloads.htm shortly. The kernel will produce a dump during CRC32 checking on faulty ULE packet. Signed-off-by: Ang Way Chuang Signed-off-by: Greg Kroah-Hartman

v4l/dvb: Backport the DISEQC regression fix to 2.6.17.x

2006-07-25T03:35:22Z

Backport the DISEQC regression fix to 2.6.17.x Signed-off-by: Andrew de Quincey Signed-off-by: Michael Krufky Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

V4L/DVB (3742): Set tone/voltage again if the frontend was reinitialised

2006-05-12T22:54:44Z

Signed-off-by: Andrew de Quincey Signed-off-by: Mauro Carvalho Chehab

V4L/DVB (3725): Fix mutex in dvb_register_device to work.

2006-05-12T22:54:37Z

This mutex is meant to stop two devices getting the same ID. dvbdev_get_free_id() scans the list of already allocated devices to find a free id. Unfortunately, since the mutex is unlocked before the card is added to the above list, it is still possible for two of them to get the same id. Its debatable whether this mutex lock is actually needed, but I'm unwilling to just remove it in case something does depend on it. Signed-off-by: Andrew de Quincey Signed-off-by: Mauro Carvalho Chehab

V4L/DVB (3673): Fix budget-av CAM reset

2006-04-02T07:56:02Z

Unfortunately on the budget-av board, the CAM reset line is tied to the frontend reset line, so resetting the CAM also zaps the frontend. This breaks the tda1004x at least, and causes it to fail to tune until the budget-av module is reloaded. This patch adds an exported function to dvb_frontend that allows a card to forcibly reinitialise a frontend. The budget-av now does this on CAM reset, which corrects this problem. since they do not tie the CAM reset line to the frontend reset line. Signed-off-by: Andrew de Quincey Signed-off-by: Mauro Carvalho Chehab

V4L/DVB (3672): Fix memory leak in dvr open

2006-04-02T07:56:01Z

The dvr device could be opened multiple times simultaneously in O_RDONLY mode. Each open after the first would allocate a new dvr buffer (1880 KB) and leak the old buffer. The first close would de-allocate the dvr buffer and cause all other open dvrs to stop working. This patch allows only a single O_RDONLY open of the drv device, as per the API specification. Multiple O_WRONLY opens are still allowed and don't appear to cause any problems. Signed-off-by: Trent Piepho Signed-off-by: Andrew de Quincey Signed-off-by: Mauro Carvalho Chehab

[PATCH] mark f_ops const in the inode

2006-03-28T17:16:05Z

Mark the f_ops members of inodes as const, as well as fix the ripple-through this causes by places that copy this f_ops and then "do stuff" with it. Signed-off-by: Arjan van de Ven Signed-off-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

V4L/DVB (3501): Dmxdev: use dvb_ringbuffer

2006-03-21T16:53:29Z

Use dvb_ringbuffer instead of an own buffer implementation in dmxdev.[ch]. Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab

V4L/DVB (3500): Ringbuffer: don't reset pointers to zero

2006-03-21T16:53:27Z

Oliver Endriss spotted, that resetting read and write pointers on flush() requires additional locking and breaks the av7110 driver. Therefore this patch partially reverts the previous patch titled "make dvb_ringbuffer compatible to dmxdev_buffer". Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab

V4L/DVB (3484): Make dvb_ringbuffer compatible to dmxdev_buffer

2006-03-21T16:53:17Z

Added variable 'error' to struct dvb_ringbuffer, which is set to zero on init() and flush(). Also reset read an write pointers to zero on flush() to get less fragmented data. Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab