Guennadi Liakhovetski 2e008074b2 media: V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space ...

commit cfece5857c upstream.

Commit 75e2bdad89 "ov7670: allow
configuration of image size, clock speed, and I/O method" uses a wrong
index to iterate an array. Apart from being wrong, it also uses an
unchecked value from user-space, which can cause access to unmapped
memory in the kernel, triggered by a normal desktop user with rights to
use V4L2 devices.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Acked-by: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2014-06-07 13:25:40 -07:00

..

cx25840

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

m5mols

[media] m5mols: Fix bug in stream on handler

2013-03-21 18:25:09 -03:00

s5c73m3

[media] s5c73m3: Fix off-by-one valid range checking for fie->index

2013-05-21 08:36:54 -03:00

smiapp

[media] Media: remove incorrect __init/__exit markups

2013-03-18 16:59:59 -03:00

soc_camera

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

ad9389b.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

adp1653.c

[media] Media: remove incorrect __init/__exit markups

2013-03-18 16:59:59 -03:00

adv7170.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

adv7175.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

adv7180.c

[media] adv7180: fix querystd() method for no input signal

2013-04-14 20:05:05 -03:00

adv7183_regs.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

adv7183.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

adv7343_regs.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

adv7343.c

[media] media: adv7343: accept configuration through platform data

2013-02-05 18:45:47 -02:00

adv7393_regs.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

adv7393.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

adv7604.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

ak881x.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

aptina-pll.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

aptina-pll.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

as3645a.c

Drivers: media: remove __dev* attributes.

2013-01-03 15:57:02 -08:00

bt819.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

bt856.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

bt866.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

cs53l32a.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

cs5345.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

ir-kbd-i2c.c

[media] saa7134: Add AverMedia A706 AverTV Satellite Hybrid+FM

2013-04-08 07:04:30 -03:00

Kconfig

[media] s5c73m3: fix indentation of the help section in Kconfig

2013-04-25 16:20:09 -03:00

ks0127.c

[media] ks0127: convert struct i2c_msg initialization to C99 format

2012-09-27 07:38:40 -03:00

ks0127.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

m52790.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

Makefile

[media] tw9906: add Techwell tw9906 video decoder

2013-03-24 13:06:39 -03:00

msp3400-driver.c

[media] v4l2: add const to argument of write-only s_tuner ioctl

2013-03-24 06:31:23 -03:00

msp3400-driver.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

msp3400-kthreads.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

mt9m032.c

[media] mt9m032: Define MT9M032_READ_MODE1 bits

2013-04-14 15:58:45 -03:00

mt9p031.c

[media] mt9p031: Use the common clock framework

2013-04-14 16:03:22 -03:00

mt9t001.c

[media] media: mt9p031/mt9t001/mt9v032: use V4L2_CID_TEST_PATTERN for test pattern control

2012-10-05 21:49:32 -03:00

mt9v011.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

mt9v032.c

[media] media: mt9p031/mt9t001/mt9v032: use V4L2_CID_TEST_PATTERN for test pattern control

2012-10-05 21:49:32 -03:00

noon010pc30.c

[media] noon010p30: Remove unneeded v4l2 control compatibility ops

2013-02-05 17:30:48 -02:00

ov7640.c

[media] ov7640: add new ov7640 driver

2013-03-24 12:23:33 -03:00

ov7670.c

media: V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space

2014-06-07 13:25:40 -07:00

ov9650.c

[media] V4L: Add driver for OV9650/52 image sensors

2013-02-05 15:21:15 -02:00

s5k4ecgx.c

[media] i2c/s5k4ecgx: fix printk format warning

2012-10-28 16:42:45 -02:00

s5k6aa.c

[media] s5k6aa: Use devm_regulator_bulk_get API

2013-02-05 17:31:22 -02:00

saa711x_regs.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

saa717x.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

saa6588.c

[media] v4l2: add const to argument of write-only s_tuner ioctl

2013-03-24 06:31:23 -03:00

saa7110.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

saa7115.c

[media] saa7115: add support for double-rate ASCLK

2013-03-24 12:10:18 -03:00

saa7127.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

saa7185.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

saa7191.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

saa7191.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

smiapp-pll.c

[media] v4l, smiapp, smiapp-pll, adp1653: Update contact information

2012-11-21 13:34:50 -02:00

smiapp-pll.h

[media] v4l, smiapp, smiapp-pll, adp1653: Update contact information

2012-11-21 13:34:50 -02:00

sony-btf-mpx.c

[media] sony-btf-mpx: v4l2_tuner struct is now constant

2013-03-24 14:04:34 -03:00

sr030pc30.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tcm825x.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tcm825x.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tda7432.c

[media] tda7432: convert to the control framework

2013-03-05 14:08:14 -03:00

tda9840.c

[media] v4l2: add const to argument of write-only s_tuner ioctl

2013-03-24 06:31:23 -03:00

tea6415c.c

[media] drivers/media/i2c/tea6415c.c: removes unnecessary semicolon

2012-09-23 17:04:38 -03:00

tea6415c.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tea6420.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tea6420.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

ths7303.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

tlv320aic23b.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tvaudio.c

[media] v4l2: add const to argument of write-only s_tuner ioctl

2013-03-24 06:31:23 -03:00

tvp514x_regs.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tvp514x.c

[media] media: tvp514x: enable TVP514X for media controller based usage

2013-03-21 14:06:29 -03:00

tvp5150_reg.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tvp5150.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

tvp7002_reg.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

tvp7002.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

tw2804.c

[media] tw2804: Revert ADC Control commit 523a4f7fbc

2013-03-25 08:13:40 -03:00

tw9903.c

[media] tw9603/6.c: use two separate const tables for the 50/60hz setup

2013-03-25 08:11:43 -03:00

tw9906.c

[media] tw9603/6.c: use two separate const tables for the 50/60hz setup

2013-03-25 08:11:43 -03:00

uda1342.c

[media] uda1342: add new uda1342 audio codec driver

2013-03-24 12:24:11 -03:00

upd64031a.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

upd64083.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

vp27smpx.c

[media] v4l2: add const to argument of write-only s_tuner ioctl

2013-03-24 06:31:23 -03:00

vpx3220.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

vs6624_regs.h

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

vs6624.c

[media] v4l2: add const to argument of write-only s_register ioctl

2013-03-24 08:47:01 -03:00

wm8739.c

[media] move i2c files into drivers/media/i2c

2012-08-15 16:42:14 -03:00

wm8775.c

media: wm8775: fix broken audio routing

2013-12-20 07:45:10 -08:00