kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Hans Verkuil 9f070b1862 media: v4l2-core: v4l2-dv-timings: check cvt/gtf result 
The v4l2_detect_cvt/gtf functions should check the result against the
timing capabilities: these functions calculate the timings, so if they
are out of bounds, they should be rejected.

To do this, add the struct v4l2_dv_timings_cap as argument to those
functions.

This required updates to the adv7604 and adv7842 drivers since the
prototype of these functions has now changed. The timings struct
that is passed to v4l2_detect_cvt/gtf in those two drivers is filled
with the timings detected by the hardware.

The vivid driver was also updated, but an additional check was added:
the width and height specified by VIDIOC_S_DV_TIMINGS has to match the
calculated result, otherwise something went wrong. Note that vivid
*emulates* hardware, so all the values passed to the v4l2_detect_cvt/gtf
functions came from the timings struct that was filled by userspace
and passed on to the driver via VIDIOC_S_DV_TIMINGS. So these fields
can contain random data. Both the constraints check via
struct v4l2_dv_timings_cap and the additional width/height check
ensure that the resulting timings are sane and not messed up by the
v4l2_detect_cvt/gtf calculations.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Fixes: 2576415846 ("[media] v4l2: move dv-timings related code to v4l2-dv-timings.c")
Cc: stable@vger.kernel.org
Reported-by: syzbot+a828133770f62293563e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-media/000000000000013050062127830a@google.com/
History 2024-10-28 15:35:56 +01:00
..
accel dma-mapping updates for linux 6.12 2024-09-19 11:12:49 +02:00
accessibility treewide: remove unnecessary <linux/version.h> inclusion 2024-08-12 18:36:44 +09:00
acpi cxl changes for v6.12 2024-09-27 11:42:03 -07:00
amba ARM: 9416/1: amba: make amba_bustype constant 2024-09-04 15:01:17 +01:00
android binder: modify the comment for binder_proc_unlock 2024-09-11 16:02:45 +02:00
ata ata fixes for 6.12-rc1 2024-09-27 09:05:18 -07:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-12 10:41:44 +01:00
auxdisplay [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
base Driver core update for 6.12-rc1 2024-09-27 08:48:37 -07:00
bcma PCI: Rename CRS Completion Status to RRS 2024-09-10 19:52:30 -05:00
block 19 hotfixes. 13 are cc:stable. 2024-09-27 10:27:22 -07:00
bluetooth [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
bus Driver core update for 6.12-rc1 2024-09-27 08:48:37 -07:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
cdx cdx: remove unused struct 'cdx_mcdi_copy_buffer' 2024-07-31 13:56:50 +02:00
char [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
clk soc: convert ep93xx to devicetree 2024-09-26 12:00:25 -07:00
clocksource Updates for x86 timers: 2024-09-17 15:27:01 +02:00
comedi comedi: ni_routing: tools: Check when the file could not be opened 2024-09-11 16:03:28 +02:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
cpufreq In the v6.12 scheduler development cycle we had 63 commits from 18 contributors: 2024-09-19 15:55:58 +02:00
cpuidle pmdomain core: 2024-09-18 10:49:45 +02:00
crypto This push fixes the following issues: 2024-09-24 10:46:54 -07:00
cxl cxl changes for v6.12 2024-09-27 11:42:03 -07:00
dax mm: make range-to-target_node lookup facility a part of numa_memblks 2024-09-03 21:15:32 -07:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: imx-bus: Use of_property_present() 2024-09-05 01:23:56 +09:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma soc: convert ep93xx to devicetree 2024-09-26 12:00:25 -07:00
dma-buf drm next for 6.12-rc1 2024-09-19 10:18:15 +02:00
dpll dpll: add Embedded SYNC feature for a pin 2024-08-26 19:21:14 -07:00
edac - Drop a now obsolete ppc4xx_edac driver 2024-09-16 06:36:37 +02:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
firewire [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
firmware [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
fpga fpga: zynq-fpga: Rename 'timeout' variable as 'time_left' 2024-08-14 23:58:14 +08:00
fsi fsi: add missing MODULE_DESCRIPTION() macros 2024-07-31 13:40:00 +02:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpu drm fixes for 6.12-rc1 2024-09-28 08:47:46 -07:00
greybus greybus: gb-beagleplay: Add firmware upload API 2024-09-12 09:04:09 +02:00
hid [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
hsi HSI: omap-ssi: Remove unnecessary debugfs_create_dir() error check 2024-08-27 15:28:56 +02:00
hte hte: tegra-194: add missing MODULE_DESCRIPTION() macro 2024-06-19 12:24:03 -07:00
hv drm next for 6.12-rc1 2024-09-19 10:18:15 +02:00
hwmon [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
hwspinlock hwspinlock: qcom: implement bust operation 2024-05-29 12:52:26 -07:00
hwtracing [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
i2c i2c-for-6.12-rc1-additional_fixes 2024-09-29 09:47:33 -07:00
i3c i3c: master: svc: Fix use after free vulnerability in svc_i3c_master Driver Due to Race Condition 2024-09-17 16:51:45 +02:00
idle intel_idle: fix ACPI _CST matching for newer Xeon platforms 2024-09-25 22:30:33 +02:00
iio Merge 6.11-rc7 into char-misc-next 2024-09-09 08:36:23 +02:00
infiniband [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
input [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
interconnect Merge branch 'icc-sm8350' into icc-next 2024-08-26 01:36:44 +03:00
iommu [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip Merge tag 'irq-core-2024-09-16' into loongarch-next 2024-09-17 22:20:12 +08:00
isdn [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
leds [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
macintosh [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
mailbox mailbox, remoteproc: omap2+: fix compile testing 2024-09-27 09:11:05 -05:00
mcb Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
md - Misc VDO fixes 2024-09-27 09:12:51 -07:00
media media: v4l2-core: v4l2-dv-timings: check cvt/gtf result 2024-10-28 15:35:56 +01:00
memory memory: pl353-smc: simplify with scoped for each OF child loop 2024-08-31 07:44:24 +02:00
memstick Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
message SCSI misc on 20240928 2024-09-29 09:22:34 -07:00
mfd - Added support for the Analog Devices ADP5585 GPIO and PWM functions. 2024-09-23 14:17:08 -07:00
misc [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
mmc [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
most Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
mtd [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
mux mux: remove usage of the deprecated ida_simple_xx() API 2024-04-29 08:20:07 -07:00
net [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
nfc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-08-29 11:49:10 -07:00
ntb ntb: Force physically contiguous allocation of rx ring buffers 2024-09-20 10:51:25 -04:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm virtio: features, fixes, cleanups 2024-09-26 08:43:17 -07:00
nvme for-6.12/block-20240925 2024-09-25 14:56:40 -07:00
nvmem Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
of Kbuild updates for v6.12 2024-09-24 13:02:06 -07:00
opp Merge branches 'pm-sleep', 'pm-opp' and 'pm-tools' 2024-09-11 19:02:23 +02:00
parisc parisc: pdc_stable: Constify struct kobj_type 2024-09-09 08:53:17 +02:00
parport sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-25 12:58:36 -07:00
pci pci-v6.12-changes 2024-09-23 12:47:06 -07:00
pcmcia Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
peci Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
perf RISC-V Patches for the 6.12 Merge Window, Part 1 2024-09-24 10:59:17 -07:00
phy phy-for-6.12 2024-09-23 14:05:10 -07:00
pinctrl soc: convert ep93xx to devicetree 2024-09-26 12:00:25 -07:00
platform [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
pmdomain pmdomain: core: Reduce debug summary table width 2024-09-13 13:41:33 +02:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power soc: convert ep93xx to devicetree 2024-09-26 12:00:25 -07:00
powercap powercap: intel_rapl: Change an error pointer to NULL 2024-08-23 15:45:17 +02:00
pps [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: ptp_ines: Remove setting of RX software timestamp 2024-09-09 17:44:42 -07:00
pwm soc: convert ep93xx to devicetree 2024-09-26 12:00:25 -07:00
rapidio driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
ras RAS/AMD/ATL: Translate normalized to system physical addresses using PRM 2024-08-01 14:36:29 +02:00
regulator regulator: sm5703: Remove because it is unused and fails to build 2024-09-13 19:08:14 +01:00
remoteproc mhu-v3, omap2+ : fix kconfig dependencies 2024-09-29 09:53:04 -07:00
reset reset: eyeq: add platform driver 2024-09-02 12:12:41 +02:00
rpmsg rpmsg: glink: Avoid -Wflex-array-member-not-at-end warnings 2024-09-13 14:09:47 -07:00
rtc [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
s390 more s390 updates for 6.12 merge window 2024-09-28 09:11:46 -07:00
sbus [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
scsi SCSI misc on 20240928 2024-09-29 09:22:34 -07:00
sh sh: intc: Replace simple_strtoul() with kstrtoul() 2024-09-26 17:25:29 +02:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus slimbus: qcom-ngd-ctrl: use 'time_left' variable with wait_for_completion_timeout() 2024-09-03 12:10:38 +02:00
soc soc: convert ep93xx to devicetree 2024-09-26 12:00:25 -07:00
soundwire soundwire updates for 6.12 2024-09-23 14:00:46 -07:00
spi [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
spmi spmi: pmic-arb: add missing newline in dev_err format strings 2024-07-31 13:49:28 +02:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging staging: media: drop vb2_ops_wait_prepare/finish 2024-10-28 09:20:09 +01:00
target scsi: target: Remove unused declarations 2024-08-22 21:15:21 -04:00
tc driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
tee optee: Fix a NULL vs IS_ERR() check 2024-09-09 12:22:06 +02:00
thermal [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
thunderbolt thunderbolt: Changes for v6.12 merge window 2024-09-11 15:17:43 +02:00
tty [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
ufs SCSI misc on 20240928 2024-09-29 09:22:34 -07:00
uio uio: Constify struct kobj_type 2024-09-11 16:02:54 +02:00
usb [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
vdpa virtio: features, fixes, cleanups 2024-09-26 08:43:17 -07:00
vfio [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
vhost virtio: features, fixes, cleanups 2024-09-26 08:43:17 -07:00
video fbdev: sisfb: Fix strbuf array overflow 2024-09-28 00:42:11 +02:00
virt [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
virtio virtio: features, fixes, cleanups 2024-09-26 08:43:17 -07:00
w1 w1: ds2482: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-06 19:18:32 +02:00
watchdog [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
xen xen: branch for v6.12-rc1a 2024-09-27 09:55:30 -07:00
zorro Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00