kernel.git/drivers/media/usb/usbvision, branch linux-3.12.y

[media] usbvision: revert commit 588afcc1

2016-06-15T07:32:05Z

commit d5468d7afaa9c9e961e150f0455a14a9f4872a98 upstream. Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces array")' should be reverted, because: * "!dev->actconfig->interface[ifnum]" won't catch a case where the value is not NULL but some garbage. This way the system may crash later with GPF. * "(ifnum >= USB_MAXINTERFACES)" does not cover all the error conditions. "ifnum" should be compared to "dev->actconfig-> desc.bNumInterfaces", i.e. compared to the number of "struct usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES. * There is a "struct usb_device" leak in this error path, as there is usb_get_dev(), but no usb_put_dev() on this path. * There is a bug of the same type several lines below with number of endpoints. The code is accessing hard-coded second endpoint ("interface->endpoint[1].desc") which may not exist. It would be great to handle this in the same patch too. * All the concerns above are resolved by already-accepted commit fa52bd50 ("[media] usbvision: fix crash on detecting device with invalid configuration") * Mailing list message: http://www.spinics.net/lists/linux-media/msg94832.html Signed-off-by: Vladis Dronov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby

usbvision: fix crash on detecting device with invalid configuration

2016-04-20T06:46:51Z

commit fa52bd506f274b7619955917abfde355e3d19ffe upstream. The usbvision driver crashes when a specially crafted usb device with invalid number of interfaces or endpoints is detected. This fix adds checks that the device has proper configuration expected by the driver. Reported-by: Ralf Spenneberg Signed-off-by: Vladis Dronov Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby

usbvision: fix leak of usb_dev on failure paths in usbvision_probe()

2016-04-20T06:46:50Z

commit afd270d1a45043cef14341bcceff62ed50e8dc9a upstream. There is no usb_put_dev() on failure paths in usbvision_probe(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby

[media] usbvision fix overflow of interfaces array

2016-03-07T13:53:48Z

commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream. This fixes the crash reported in: http://seclists.org/bugtraq/2015/Oct/35 The interface number needs a sanity check. Signed-off-by: Oliver Neukum Cc: Vladis Dronov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby

[media] usbvision: fix locking error

2015-10-28T15:38:32Z

commit e2c84ccb0fbe5e524d15bb09c042a6ca634adaed upstream. If remove_pending is non-zero, then the v4l2_lock is never unlocked. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Cc: Oliver Neukum Signed-off-by: Jiri Slaby

[media] usbvision-video: two use after frees

2014-11-19T21:46:10Z

commit 470a9147899500eb4898f77816520c4b4aa1a698 upstream. The lock has been freed in usbvision_release() so there is no need to call mutex_unlock() here. Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jiri Slaby

[media] usbvision-video: fix memory leak of alt_max_pkt_size

2013-06-21T14:29:24Z

1. usbvision->alt_max_pkt_size is not deallocated anywhere. 2. if allocation of usbvision->alt_max_pkt_size fails, there is no proper deallocation of already acquired resources. The patch adds kfree(usbvision->alt_max_pkt_size) to usbvision_release() as soon as other deallocations happen there. It calls usbvision_release() if allocation of usbvision->alt_max_pkt_size fails as soon as usbvision_release() is safe to work with incompletely initialized usbvision structure. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] v4l2: remove obsolete v4l2_chip_match_host()

2013-06-21T13:30:54Z

This function is no longer needed since it is now the responsibility of the v4l2 core to check if the DBG_G/S_REGISTER and DBG_G_CHIP_INFO ioctls are called for the bridge driver or not. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] usbvision: replace current_norm by g_std

2013-06-17T12:37:23Z

current_norm use is deprecated because it is per-devicenode and if you have more device nodes all dependent on the same video source, then this no longer works. Just implement g_std instead. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24T11:47:01Z

This ioctl is defined as IOW, so pass the argument as const. Signed-off-by: Hans Verkuil Acked-by: Guennadi Liakhovetski Acked-by: Lad, Prabhakar Signed-off-by: Mauro Carvalho Chehab