kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/include/media/davinci
History
Prabhakar Lad fa179e66ab media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS 
commit d75cf0144f upstream.

drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons:

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 3.16: deleted code was slightly different]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-11-20 18:04:46 +00:00
..
ccdc_types.h V4L/DVB (12252): v4l: ccdc types used across ccdc modules for vpfe capture driver 2009-09-19 00:18:18 -03:00
dm355_ccdc.h [media] davinci: more gama -> gamma typo fixes 2013-03-19 16:16:23 -03:00
dm644x_ccdc.h media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS 2018-11-20 18:04:46 +00:00
isif.h Fix common misspellings 2011-03-31 11:26:23 -03:00
vpbe.h [media] v4l2: pass std by value to the write-only s_std ioctl 2013-03-24 06:47:00 -03:00
vpbe_display.h [media] media: davinci: vpbe: use v4l2_fh for priority handling 2014-04-16 18:23:45 -03:00
vpbe_osd.h [media] media: davinci: vpbe: fix checkpatch warning for CamelCase 2013-05-21 08:19:17 -03:00
vpbe_types.h [media] davinci: remove VPBE_ENC_DV_PRESET and rename VPBE_ENC_CUSTOM_TIMINGS 2013-03-19 16:09:53 -03:00
vpbe_venc.h [media] davinci: vpbe: pass different platform names to handle different ip's 2012-12-21 14:18:50 -02:00
vpfe_capture.h media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS 2018-11-20 18:04:46 +00:00
vpfe_types.h V4L/DVB (12248): v4l: vpfe capture bridge driver for DM355 and DM6446 2009-09-19 00:18:12 -03:00
vpif_types.h [media] media: davinci: vpif: display: add V4L2-async support 2013-07-26 13:17:15 -03:00
vpss.h [media] davinci/vpss: add helper functions for setting hw params 2012-12-21 14:07:20 -02:00