linux/drivers/media/usb
Ludwig Disterhof 5427dda195 media: usbtv: Lock resolution while streaming
commit 7e40e0bb77 upstream.

When an program is streaming (ffplay) and another program (qv4l2)
changes the TV standard from NTSC to PAL, the kernel crashes due to trying
to copy to unmapped memory.

Changing from NTSC to PAL increases the resolution in the usbtv struct,
but the video plane buffer isn't adjusted, so it overflows.

Fixes: 0e0fe3958f ("[media] usbtv: Add support for PAL video source")
Cc: stable@vger.kernel.org
Signed-off-by: Ludwig Disterhof <ludwig@disterhof.eu>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
[hverkuil: call vb2_is_busy instead of vb2_is_streaming]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-08-28 16:24:29 +02:00
..
airspy media: rtl2832_sdr/vivid/airspy/hackrf/msi2500: drop memset of fmt.sdr.reserved 2021-05-19 09:51:39 +02:00
as102 treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118 2019-05-24 17:39:02 +02:00
au0828 media: au0828: fix a NULL vs IS_ERR() check 2021-06-02 13:30:28 +02:00
b2c2 media: flexcop-usb: fix sanity check of bNumEndpoints 2024-06-16 13:39:44 +02:00
cpia2 media: cpia2: fix control-message timeouts 2022-01-27 11:02:55 +01:00
cx231xx media: cx231xx: set device_caps for 417 2025-06-04 14:37:58 +02:00
dvb-usb media: cxusb: no longer judge rbuf when the write fails 2025-06-27 11:05:24 +01:00
dvb-usb-v2 media: lmedm04: Handle errors for lme2510_int_read 2025-03-13 12:50:08 +01:00
em28xx media: em28xx: annotate unchecked call to media_device_register() 2024-03-26 18:21:26 -04:00
go7007 media: go7007: fix a memleak in go7007_load_encoder 2024-03-26 18:21:30 -04:00
gspca media: gspca: Add bounds checking to firmware parser 2025-08-28 16:24:29 +02:00
hackrf media: rtl2832_sdr/vivid/airspy/hackrf/msi2500: drop memset of fmt.sdr.reserved 2021-05-19 09:51:39 +02:00
hdpvr media: usb: hdpvr: disable zero-length read messages 2025-08-28 16:24:24 +02:00
msi2500 media: rtl2832_sdr/vivid/airspy/hackrf/msi2500: drop memset of fmt.sdr.reserved 2021-05-19 09:51:39 +02:00
pvrusb2 media: pvrusb2: fix uaf in pvr2_context_set_notify 2024-03-26 18:21:30 -04:00
pwc treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
s2255 media: s2255: Use refcount_t instead of atomic_t for num_channels 2024-07-18 13:07:28 +02:00
siano drivers: usb: smsusb: fix error handling code in smsusb_init_device 2023-09-19 12:22:43 +02:00
stk1160 media: stk1160: fix bounds checking in stk1160_copy_video() 2024-06-16 13:39:43 +02:00
stkwebcam media: stkwebcam: fix memory leak in stk_camera_probe 2021-07-22 14:01:55 +02:00
tm6000 media: tm6000: Avoid card name truncation 2021-11-18 19:16:29 +01:00
ttusb-budget media: dvb-ttusb-budget: cleanup printk logic 2020-09-03 11:15:47 +02:00
ttusb-dec media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() 2023-06-09 10:32:24 +02:00
usbtv media: usbtv: Lock resolution while streaming 2025-08-28 16:24:29 +02:00
uvc media: uvcvideo: Do not mark valid metadata as invalid 2025-08-28 16:24:27 +02:00
zr364xx media: zr364xx: fix memory leak in zr364xx_start_readpipe 2021-06-02 13:35:15 +02:00
Kconfig media: move ttpci-eeprom to common 2021-06-02 11:16:15 +02:00
Makefile media: move CEC USB drivers to a separate directory 2020-04-15 12:06:40 +02:00