Skip to content

Commit ceb0613

Browse files
torvaldstorvalds
committed
Merge tag 'media/v6.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab: - dvb-core fixes for vb2 check and device registration - v4l2-core: fix an issue with error handling for VIDIOC_G_CTRL - vb2 core: fix an issue with vb plane copy logic - videobuf2-core: copy vb planes unconditionally - vivid: fix buffer overwrite when using > 32 buffers - vivid: fix a potential division by zero due to an issue at v4l2-tpg - some spectre vulnerability fixes - several OOM access fixes - some buffer overflow fixes * tag 'media/v6.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: videobuf2-core: copy vb planes unconditionally media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set media: vivid: fix buffer overwrite when using > 32 buffers media: pulse8-cec: fix data timestamp at pulse8_setup() media: cec: extron-da-hd-4k-plus: don't use -1 as an error code media: stb0899_algo: initialize cfr before using it media: adv7604: prevent underflow condition when reporting colorspace media: cx24116: prevent overflows on SNR calculus media: ar0521: don't overflow when checking PLL values media: s5p-jpeg: prevent buffer overflows media: av7110: fix a spectre vulnerability media: mgb4: protect driver against spectre media: dvb_frontend: don't play tricks with underflow values media: dvbdev: prevent the risk of out of memory access media: v4l2-tpg: prevent the risk of a division by zero media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() media: dvb-core: add missing buffer index check
2 parents f1dce1f + 702a47c commit ceb0613

File tree

20 files changed

+118
-63
lines changed

20 files changed

+118
-63
lines changed

‎drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -348,12 +348,12 @@ static int get_edid_tag_location(const u8 *edid, unsigned int size,
348348

349349
/* Return if not a CTA-861 extension block */
350350
if (size < 256 || edid[0] != 0x02 || edid[1] != 0x03)
351-
return -1;
351+
return -ENOENT;
352352

353353
/* search tag */
354354
d = edid[0x02] & 0x7f;
355355
if (d <= 4)
356-
return -1;
356+
return -ENOENT;
357357

358358
i = 0x04;
359359
end = 0x00 + d;
@@ -371,7 +371,7 @@ static int get_edid_tag_location(const u8 *edid, unsigned int size,
371371
return offset + i;
372372
i += len + 1;
373373
} while (i < end);
374-
return -1;
374+
return -ENOENT;
375375
}
376376

377377
static void extron_edid_crc(u8 *edid)

‎drivers/media/cec/usb/pulse8/pulse8-cec.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -685,7 +685,7 @@ static int pulse8_setup(struct pulse8 *pulse8, struct serio *serio,
685685
err = pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4);
686686
if (err)
687687
return err;
688-
date = (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
688+
date = ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3];
689689
dev_info(pulse8->dev, "Firmware build date %ptT\n", &date);
690690

691691
dev_dbg(pulse8->dev, "Persistent config:\n");

‎drivers/media/common/v4l2-tpg/v4l2-tpg-core.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg)
17951795
unsigned p;
17961796
unsigned x;
17971797

1798+
if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width))
1799+
return;
1800+
17981801
switch (tpg->pattern) {
17991802
case TPG_PAT_GREEN:
18001803
contrast = TPG_COLOR_100_RED;

‎drivers/media/common/videobuf2/videobuf2-core.c‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1482,18 +1482,23 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)
14821482
}
14831483
vb->planes[plane].dbuf_mapped = 1;
14841484
}
1485+
} else {
1486+
for (plane = 0; plane < vb->num_planes; ++plane)
1487+
dma_buf_put(planes[plane].dbuf);
1488+
}
14851489

1486-
/*
1487-
* Now that everything is in order, copy relevant information
1488-
* provided by userspace.
1489-
*/
1490-
for (plane = 0; plane < vb->num_planes; ++plane) {
1491-
vb->planes[plane].bytesused = planes[plane].bytesused;
1492-
vb->planes[plane].length = planes[plane].length;
1493-
vb->planes[plane].m.fd = planes[plane].m.fd;
1494-
vb->planes[plane].data_offset = planes[plane].data_offset;
1495-
}
1490+
/*
1491+
* Now that everything is in order, copy relevant information
1492+
* provided by userspace.
1493+
*/
1494+
for (plane = 0; plane < vb->num_planes; ++plane) {
1495+
vb->planes[plane].bytesused = planes[plane].bytesused;
1496+
vb->planes[plane].length = planes[plane].length;
1497+
vb->planes[plane].m.fd = planes[plane].m.fd;
1498+
vb->planes[plane].data_offset = planes[plane].data_offset;
1499+
}
14961500

1501+
if (reacquired) {
14971502
/*
14981503
* Call driver-specific initialization on the newly acquired buffer,
14991504
* if provided.
@@ -1503,9 +1508,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)
15031508
dprintk(q, 1, "buffer initialization failed\n");
15041509
goto err_put_vb2_buf;
15051510
}
1506-
} else {
1507-
for (plane = 0; plane < vb->num_planes; ++plane)
1508-
dma_buf_put(planes[plane].dbuf);
15091511
}
15101512

15111513
ret = call_vb_qop(vb, buf_prepare, vb);

‎drivers/media/dvb-core/dvb_frontend.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -443,8 +443,8 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra
443443

444444
default:
445445
fepriv->auto_step++;
446-
fepriv->auto_sub_step = -1; /* it'll be incremented to 0 in a moment */
447-
break;
446+
fepriv->auto_sub_step = 0;
447+
continue;
448448
}
449449

450450
if (!ready) fepriv->auto_sub_step++;

‎drivers/media/dvb-core/dvb_vb2.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -366,9 +366,15 @@ int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
366366
int dvb_vb2_expbuf(struct dvb_vb2_ctx *ctx, struct dmx_exportbuffer *exp)
367367
{
368368
struct vb2_queue *q = &ctx->vb_q;
369+
struct vb2_buffer *vb2 = vb2_get_buffer(q, exp->index);
369370
int ret;
370371

371-
ret = vb2_core_expbuf(&ctx->vb_q, &exp->fd, q->type, q->bufs[exp->index],
372+
if (!vb2) {
373+
dprintk(1, "[%s] invalid buffer index\n", ctx->name);
374+
return -EINVAL;
375+
}
376+
377+
ret = vb2_core_expbuf(&ctx->vb_q, &exp->fd, q->type, vb2,
372378
0, exp->flags);
373379
if (ret) {
374380
dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,

‎drivers/media/dvb-core/dvbdev.c‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,15 @@ static DECLARE_RWSEM(minor_rwsem);
8686
static int dvb_device_open(struct inode *inode, struct file *file)
8787
{
8888
struct dvb_device *dvbdev;
89+
unsigned int minor = iminor(inode);
90+
91+
if (minor >= MAX_DVB_MINORS)
92+
return -ENODEV;
8993

9094
mutex_lock(&dvbdev_mutex);
9195
down_read(&minor_rwsem);
92-
dvbdev = dvb_minors[iminor(inode)];
96+
97+
dvbdev = dvb_minors[minor];
9398

9499
if (dvbdev && dvbdev->fops) {
95100
int err = 0;
@@ -525,7 +530,10 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
525530
for (minor = 0; minor < MAX_DVB_MINORS; minor++)
526531
if (!dvb_minors[minor])
527532
break;
528-
if (minor == MAX_DVB_MINORS) {
533+
#else
534+
minor = nums2minor(adap->num, type, id);
535+
#endif
536+
if (minor >= MAX_DVB_MINORS) {
529537
if (new_node) {
530538
list_del(&new_node->list_head);
531539
kfree(dvbdevfops);
@@ -538,9 +546,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
538546
mutex_unlock(&dvbdev_register_lock);
539547
return -EINVAL;
540548
}
541-
#else
542-
minor = nums2minor(adap->num, type, id);
543-
#endif
549+
544550
dvbdev->minor = minor;
545551
dvb_minors[minor] = dvb_device_get(dvbdev);
546552
up_write(&minor_rwsem);

‎drivers/media/dvb-frontends/cx24116.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -741,6 +741,7 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe, u16 *snr)
741741
{
742742
struct cx24116_state *state = fe->demodulator_priv;
743743
u8 snr_reading;
744+
int ret;
744745
static const u32 snr_tab[] = { /* 10 x Table (rounded up) */
745746
0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667,
746747
0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667,
@@ -749,7 +750,11 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe, u16 *snr)
749750

750751
dprintk("%s()\n", __func__);
751752

752-
snr_reading = cx24116_readreg(state, CX24116_REG_QUALITY0);
753+
ret = cx24116_readreg(state, CX24116_REG_QUALITY0);
754+
if (ret < 0)
755+
return ret;
756+
757+
snr_reading = ret;
753758

754759
if (snr_reading >= 0xa0 /* 100% */)
755760
*snr = 0xffff;

‎drivers/media/dvb-frontends/stb0899_algo.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@ static enum stb0899_status stb0899_search_carrier(struct stb0899_state *state)
269269

270270
short int derot_freq = 0, last_derot_freq = 0, derot_limit, next_loop = 3;
271271
int index = 0;
272-
u8 cfr[2];
272+
u8 cfr[2] = {0};
273273
u8 reg;
274274

275275
internal->status = NOCARRIER;

‎drivers/media/i2c/adv7604.c‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2519,10 +2519,10 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
25192519
const struct adv76xx_chip_info *info = state->info;
25202520
struct v4l2_dv_timings timings;
25212521
struct stdi_readback stdi;
2522-
u8 reg_io_0x02 = io_read(sd, 0x02);
2522+
int ret;
2523+
u8 reg_io_0x02;
25232524
u8 edid_enabled;
25242525
u8 cable_det;
2525-
25262526
static const char * const csc_coeff_sel_rb[16] = {
25272527
"bypassed", "YPbPr601 -> RGB", "reserved", "YPbPr709 -> RGB",
25282528
"reserved", "RGB -> YPbPr601", "reserved", "RGB -> YPbPr709",
@@ -2621,13 +2621,21 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
26212621
v4l2_info(sd, "-----Color space-----\n");
26222622
v4l2_info(sd, "RGB quantization range ctrl: %s\n",
26232623
rgb_quantization_range_txt[state->rgb_quantization_range]);
2624-
v4l2_info(sd, "Input color space: %s\n",
2625-
input_color_space_txt[reg_io_0x02 >> 4]);
2626-
v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n",
2627-
(reg_io_0x02 & 0x02) ? "RGB" : "YCbCr",
2628-
(((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ?
2629-
"(16-235)" : "(0-255)",
2630-
(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
2624+
2625+
ret = io_read(sd, 0x02);
2626+
if (ret < 0) {
2627+
v4l2_info(sd, "Can't read Input/Output color space\n");
2628+
} else {
2629+
reg_io_0x02 = ret;
2630+
2631+
v4l2_info(sd, "Input color space: %s\n",
2632+
input_color_space_txt[reg_io_0x02 >> 4]);
2633+
v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n",
2634+
(reg_io_0x02 & 0x02) ? "RGB" : "YCbCr",
2635+
(((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ?
2636+
"(16-235)" : "(0-255)",
2637+
(reg_io_0x02 & 0x08) ? "enabled" : "disabled");
2638+
}
26312639
v4l2_info(sd, "Color space conversion: %s\n",
26322640
csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]);
26332641

0 commit comments

Comments
 (0)