- 19 Jul, 2023 33 commits
-
-
Zhang Shurong authored
In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by:
Zhang Shurong <zhang_shurong@foxmail.com> Signed-off-by:
Hans Verkuil <hverkuil-cisco@xs4all.nl>
-
Zhang Shurong authored
If opera1_xilinx_rw fails, the mac address is not initialized. And opera1_read_mac_address does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init. Fix this by handling the failure of opera1_xilinx_rw. Signed-off-by:
-
Zhang Shurong authored
In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by:
-
Zhang Shurong authored
In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by:
-
Zhang Shurong authored
In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9005_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by:
-
Zhang Shurong authored
In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach dw2102_i2c_transfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 950e252c ("[media] dw2102: limit messages to buffer size") Signed-off-by:
-
Yangtao Li authored
Use devm_platform_ioremap_resource() to simplify code. Signed-off-by:
Yangtao Li <frank.li@vivo.com> Signed-off-by:
-
Yangtao Li authored
Use devm_platform_ioremap_resource() to simplify code. Signed-off-by:
-
Yangtao Li authored
Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by:
Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by:
-
Yangtao Li authored
Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by:
-
Yangtao Li authored
media: verisilicon: Convert to devm_platform_ioremap_resource() and devm_platform_ioremap_resource_byname() Use devm_platform_ioremap_resource() and devm_platform_ioremap_resource_byname() to simplify code. Signed-off-by:
Chen-Yu Tsai <wenst@chromium.org> Signed-off-by:
-
Yangtao Li authored
Use devm_platform_ioremap_resource() to simplify code. Signed-off-by:
-
Yangtao Li authored
Use devm_platform_ioremap_resource() to simplify code. Signed-off-by:
-
Yangtao Li authored
Use devm_platform_ioremap_resource() to simplify code. Signed-off-by:
-
Yangtao Li authored
Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by:
-
Yangtao Li authored
Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by:
-
Yangtao Li authored
Use devm_platform_ioremap_resource() to simplify code. Signed-off-by:
-
Zhang Shurong authored
In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by:
-
Minjie Du authored
make second_timeout avoid double assignment. Signed-off-by:
Minjie Du <duminjie@vivo.com> Signed-off-by:
-
Colin Ian King authored
There is a spelling mistake in a fmdbg message. Fix it. Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Signed-off-by:
-
Jeffrey Hugo authored
source.codeaurora.org is no longer accessible and so the reference links in the documentation are not useful. The content was mirrored over to Code Linaro so lets update the references to point there instead. Signed-off-by:
Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by:
Bryan O'Donoghue <bryan.odonoghue@linaro.org> Signed-off-by:
-
Daniil Dulov authored
If cx24120_message_send() returns error, we should keep local struct unchanged. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 5afc9a25 ("[media] Add support for TechniSat Skystar S2") Signed-off-by:
Daniil Dulov <d.dulov@aladdin.ru> Signed-off-by:
-
Lu Hongfei authored
Use put_device to release the object get through of_find_device_by_node, avoiding resource leaks. Signed-off-by:
Lu Hongfei <luhongfei@vivo.com> Signed-off-by:
-
Christophe JAILLET authored
'read' is freed when it is known to be NULL, but not when a read error occurs. Revert the logic to avoid a small leak, should a m920x_read() call fail. Fixes: a2ab06d7 ("media: m920x: don't use stack on USB reads") Signed-off-by:
Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by:
-
Alexander Stein authored
Add the error code of a failed i2c transfer to the error message. Signed-off-by:
Alexander Stein <alexander.stein@ew.tq-group.com> Reviewed-by:
Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Daniil Dulov authored
Variable loopdiv can be assigned 0, then it is used as a denominator, without checking it for 0. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 713d54a8 ("[media] DiB7090: add support for the dib7090 based") Signed-off-by:
-
Yu Zhe authored
Pointer variables of void * type do not require type cast. Signed-off-by:
Yu Zhe <yuzhe@nfschina.com> Signed-off-by:
-
Yu Zhe authored
Pointer variables of void * type do not require type cast. Signed-off-by:
-
Yu Zhe authored
Pointer variables of void * type do not require type cast. Signed-off-by:
-
Dongliang Mu authored
The previous commit 4b208f8b ("[media] siano: register media controller earlier")moves siano_media_device_register before smscore_register_device, and adds corresponding error handling code if smscore_register_device fails. However, it misses the following error handling code of smsusb_init_device. Fix this by moving error handling code at the end of smsusb_init_device and adding a goto statement in the following error handling parts. Fixes: 4b208f8b ("[media] siano: register media controller earlier") Signed-off-by:
Dongliang Mu <dzm91@hust.edu.cn> Signed-off-by:
-
Dong Chuanjian authored
remove unnecessary void* type casting. Signed-off-by:
Dong Chuanjian <chuanjian@nfschina.com> Signed-off-by:
-
ye xingchen authored
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by:
ye xingchen <ye.xingchen@zte.com.cn> Signed-off-by:
-
ye xingchen authored
Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by:
Tommaso Merciai <tommaso.merciai@amarulasolutions.com> Signed-off-by:
-
- 14 Jul, 2023 7 commits
-
-
Christophe JAILLET authored
If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL, so fwnode_handle_put() is a no-op. Release the reference taken from a previous fwnode_graph_get_port_parent() call instead. Also handle fwnode_graph_get_port_parent() failures. In order to fix these issues, add an error handling path to the function and the needed gotos. Fixes: ca50c197 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties") Signed-off-by:
Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by:
Mauro Carvalho Chehab <mchehab@kernel.org>
-
Tomi Valkeinen authored
Add driver for TI DS90UB953 FPD-Link III Serializer. Signed-off-by:
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Reviewed-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by:
-
Tomi Valkeinen authored
Add driver for TI DS90UB913 FPD-Link III Serializer. Signed-off-by:
-
Tomi Valkeinen authored
Add driver for TI DS90UB960 FPD-Link III Deserializer. Signed-off-by:
-
Tomi Valkeinen authored
Add DT bindings for TI DS90UB960 FPD-Link III Deserializer. Signed-off-by:
Rob Herring <robh@kernel.org> Reviewed-by:
-
Tomi Valkeinen authored
Add DT bindings for TI DS90UB953 FPD-Link III Serializer. Signed-off-by:
-
Tomi Valkeinen authored
Add DT bindings for TI DS90UB913 FPD-Link III Serializer. Signed-off-by:
-
