Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/drivers
History
Alistair Strachan dd945fcac6 media: uvcvideo: Fix 'type' check leading to overflow 
commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream.

When initially testing the Camera Terminal Descriptor wTerminalType
field (buffer[4]), no mask is used. Later in the function, the MSB is
overloaded to store the descriptor subtype, and so a mask of 0x7fff
is used to check the type.

If a descriptor is specially crafted to set this overloaded bit in the
original wTerminalType field, the initial type check will fail (falling
through, without adjusting the buffer size), but the later type checks
will pass, assuming the buffer has been made suitably large, causing an
overflow.

Avoid this problem by checking for the MSB in the wTerminalType field.
If the bit is set, assume the descriptor is bad, and abort parsing it.

Originally reported here:
https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8
A similar (non-compiling) patch was provided at that time.

Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Alistair Strachan <astrachan@google.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2019-07-27 22:08:31 +02:00
..
accessibility
…
acpi ACPI: APEI / ERST: Fix missing error handling in erst_reader() 2019-07-27 21:46:19 +02:00
amba
…
android UPSTREAM: binder: fix proc->files use-after-free 2019-07-27 22:05:56 +02:00
ata libata: array underflow in ata_find_dev() 2019-07-27 21:44:15 +02:00
atm
…
auxdisplay
…
base PM / wakeup: Only update last time for active wakeup sources 2019-07-27 21:52:47 +02:00
battery Import T813XXS2BRC2 kernel source changes 2018-05-26 00:39:42 +02:00
battery_v2 Import latest Samsung release 2017-04-18 03:43:52 +02:00
bcma
…
bif
…
block block/loop: Use global lock for ioctl() operation. 2019-07-27 21:53:37 +02:00
bluetooth Merge tag 'LA.BR.1.3.6-05410-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2018-02-06 13:11:45 +01:00
bus
…
cdrom BACKPORT: block: add blk_rq_set_block_pc() 2017-04-22 23:03:01 +02:00
char random: mix rdrand with entropy sent in from userspace 2019-07-27 21:52:57 +02:00
clk clk: qcom: mdss: initialise spread freq variable before usage 2019-07-27 21:51:05 +02:00
clocksource Merge tag 'LA.BR.1.3.6-05410-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2018-02-06 13:11:45 +01:00
connector
…
coresight coresight: tmc: Fix use after free issue with tmc read 2017-07-30 10:34:00 -07:00
cpufreq cpufreq: interactive governor drops bits in time calculation 2019-07-27 21:50:42 +02:00
cpuidle cpuidle: Remove unnecessary WARN for calculate_residency 2019-07-27 21:45:56 +02:00
crypto crypto: hash - annotate algorithms taking optional key 2019-07-27 21:49:17 +02:00
dca
…
debug Import latest Samsung release 2017-04-18 03:43:52 +02:00
debug_32 Import latest Samsung release 2017-04-18 03:43:52 +02:00
devfreq dev_freq: devfreq_spdm: add null terminator to prevent OOB access 2019-07-27 21:50:47 +02:00
dio
…
dma Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
edac This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
eisa
…
esoc
…
extcon Import latest Samsung release 2017-04-18 03:43:52 +02:00
fingerprint drivers: fingerprint: Kill FEATURE_SPI_WAKELOCK 2017-04-19 17:02:36 +02:00
firewire This is the 3.10.95 stable release 2017-04-18 17:14:54 +02:00
firmware Import T813XXU2BQD1 kernel source changes 2017-04-22 16:30:03 +02:00
gpio gpio: Handle EPROBE_DEFER while probing 2019-07-27 21:45:55 +02:00
gpu drm: set FMODE_UNSIGNED_OFFSET for drm files 2019-07-27 21:52:11 +02:00
hid HID: hiddev: fix potential Spectre v1 2019-07-27 22:06:00 +02:00
hsi
…
hv
…
hwmon This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
hwspinlock
…
i2c i2c: dev: prevent adapter retries and timeout being set as minus value 2019-07-27 21:53:34 +02:00
ide UPSTREAM: block: disable entropy contributions for nonrot devices 2019-07-27 21:47:56 +02:00
idle
…
iio iio:kfifo_buf: check for uint overflow 2019-07-27 21:52:28 +02:00
infiniband
…
input BACKPORT: Input: xpad - fix oops when attaching an unknown Xbox One gamepad 2019-07-27 21:50:43 +02:00
iommu iommu/amd: Finish TLB flush in amd_iommu_unmap() 2019-07-27 21:44:19 +02:00
ipack
…
irqchip Import latest Samsung release 2017-04-18 03:43:52 +02:00
isdn
…
leds Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD 2017-04-18 12:11:50 +02:00
lguest Import latest Samsung release 2017-04-18 03:43:52 +02:00
macintosh
…
mailbox
…
md dm kcopyd: avoid softlockup in run_complete_job 2019-07-27 21:51:38 +02:00
media media: uvcvideo: Fix 'type' check leading to overflow 2019-07-27 22:08:31 +02:00
memory
…
memstick
…
message
…
mfd mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode 2019-07-27 21:44:34 +02:00
misc qseecom: Fix typo in format specifier 2019-07-27 21:44:44 +02:00
mmc mmc: core: Reset HPI enabled state during re-init and in case of errors 2019-07-27 21:53:32 +02:00
motor Import latest Samsung release 2017-04-18 03:43:52 +02:00
mtd UPSTREAM: block: disable entropy contributions for nonrot devices 2019-07-27 21:47:56 +02:00
muic muic: Fix WRITE redefined compile error 2019-07-27 22:05:59 +02:00
net qcacld-2.0: Add check for bss_list size in wma_group_num_bss_to_scan_id 2019-07-27 22:08:31 +02:00
nfc Import latest Samsung release 2017-04-18 03:43:52 +02:00
ntb
…
nubus
…
of of: fdt: add missing allocation-failure check 2019-07-27 21:44:47 +02:00
oprofile
…
parisc
…
parport
…
pci PCI / PM: Force devices to D0 in pci_pm_thaw_noirq() 2019-07-27 21:46:19 +02:00
pcmcia
…
phy
…
pinctrl pinctrl: Really force states during suspend/resume 2019-07-27 21:49:40 +02:00
platform msm: ipa: Protect ipa default routing table 2019-07-27 22:05:55 +02:00
pnp
…
power drivers: qcom: lpm-stats: Fix undefined access error 2019-07-27 21:50:48 +02:00
pps
…
ps3
…
ptp
…
pwm
…
rapidio
…
regulator Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
remoteproc
…
reset
…
rpmsg
…
rtc rtc: set the alarm to the next expiring timer 2019-07-27 21:46:00 +02:00
s390 UPSTREAM: block: disable entropy contributions for nonrot devices 2019-07-27 21:47:56 +02:00
sbus
…
scsi scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() 2019-07-27 21:51:41 +02:00
sensorhub Import T713XXU2BQD3 kernel source changes 2017-07-01 12:51:07 +02:00
sensors Import latest Samsung release 2017-04-18 03:43:52 +02:00
sfi
…
sh
…
slimbus slim-msm: Synchronize SSR callbacks 2017-05-05 19:20:28 +00:00
sn
…
soc voice_svc: Avoid double free in voice_svc driver 2019-07-27 21:51:22 +02:00
soundwire
…
spi This is the 3.10.97 stable release 2017-04-18 17:17:20 +02:00
spmi Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD 2017-04-18 12:11:50 +02:00
ssb
…
ssbi
…
staging staging: android: fix a possible memory leak 2019-07-27 22:08:31 +02:00
switch
…
target scsi: target: fix __transport_register_session locking 2019-07-27 21:51:38 +02:00
tc
…
thermal msm_thermal: Handle defer while probing 2019-07-27 21:45:58 +02:00
tty tty: make n_tty_read() always abort if hangup is in progress 2019-07-27 21:49:23 +02:00
uio uio: Fix an Oops on load 2019-07-27 22:06:01 +02:00
usb usb: hub: delay hub autosuspend if USB3 port is still link training 2019-07-27 22:06:03 +02:00
uwb
…
vfio
…
vhost Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
video BACKPORT: msm: mdss: Fix invalid dma attachment during fb shutdown 2019-07-27 21:51:53 +02:00
virt
…
virtio
…
vlynq
…
vme
…
w1
…
watchdog
…
xen This is the 3.10.96 stable release 2017-04-18 17:16:02 +02:00
zorro
…
Kconfig msm: gud: Remove gud driver 2017-09-08 18:49:12 +00:00
Makefile msm: gud: Remove gud driver 2017-09-08 18:49:12 +00:00