linux-stable.git/drivers/media/usb, branch linux-4.6.y

media: fix airspy usb probe error path

2016-08-10T10:54:49+00:00

commit aa93d1fee85c890a34f2510a310e55ee76a27848 upstream.

Fix a memory leak on probe error of the airspy usb device driver.

The problem is triggered when more than 64 usb devices register with
v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.

The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.

A badusb device can emulate 64 of these devices, and then through
continual emulated connect/disconnect of the 65th device, cause the
kernel to run out of RAM and crash the kernel, thus causing a local DOS
vulnerability.

Fixes CVE-2016-5400

Signed-off-by: James Patrick-Evans 
Reviewed-by: Kees Cook 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

uvc: Forward compat ioctls to their handlers directly

2016-07-27T15:42:11+00:00

commit a44323e2a8f342848bb77e8e04fcd85fcb91b3b4 upstream.

The current code goes through a lot of indirection just to call a
known handler.  Simplify it: just call the handlers directly.

Signed-off-by: Andy Lutomirski 
Signed-off-by: Greg Kroah-Hartman

[media] usbvision: revert commit 588afcc1

2016-04-20T18:58:54+00:00

Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces
array")' should be reverted, because:

* "!dev->actconfig->interface[ifnum]" won't catch a case where the value
is not NULL but some garbage. This way the system may crash later with
GPF.

* "(ifnum >= USB_MAXINTERFACES)" does not cover all the error
conditions. "ifnum" should be compared to "dev->actconfig->
desc.bNumInterfaces", i.e. compared to the number of "struct
usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES.

* There is a "struct usb_device" leak in this error path, as there is
usb_get_dev(), but no usb_put_dev() on this path.

* There is a bug of the same type several lines below with number of
endpoints. The code is accessing hard-coded second endpoint
("interface->endpoint[1].desc") which may not exist. It would be great
to handle this in the same patch too.

* All the concerns above are resolved by already-accepted commit fa52bd50
("[media] usbvision: fix crash on detecting device with invalid
configuration")

* Mailing list message:
http://www.spinics.net/lists/linux-media/msg94832.html

Signed-off-by: Vladis Dronov 
Signed-off-by: Hans Verkuil 
Cc:       # for v4.5
Signed-off-by: Mauro Carvalho Chehab

[media] Revert "[media] media: au0828 change to use Managed Media Controller API"

2016-03-31T18:09:04+00:00

Extending the lifetime of the media_device struct is not handled well
by the core, as it will erase some data from the struct, when
media_device_cleanup() is called after unregistering it.

While we have a fixup patch for it already, the usage of those new
functions are needed only when we share data with other drivers.

So, better to revert the changes.

This reverts commit 182dde7c5d4c ("[media] media: au0828 change
to use Managed Media Controller API")

Signed-off-by: Mauro Carvalho Chehab

[media] au0828: Fix dev_state handling

2016-03-31T18:01:35+00:00

The au0828 dev_state is actually a bit mask. It should not be
checking with "==" but, instead, with a logic and. There are some
places where it was doing it wrong.

Fix that by replacing the dev_state set/clear/test with the
bitops.

As reviewed by Shuah:
	"Looks good. Tested running bind/unbind au0828 loop for 1000 times.
	Didn't see any problems and the v4l2_querycap() problem has been
	fixed with this patch.

	After the above test, ran bind/unbind snd_usb_audio 1000 times.
	Didn't see any problems. Generated media graph and the graph
	looks good."

Cc: stable@vger.kernel.org
Reviewed-by: Shuah Khan 
Tested-by: Shuah Khan 
Signed-off-by: Mauro Carvalho Chehab

[media] au0828: fix au0828_v4l2_close() dev_state race condition

2016-03-31T18:01:08+00:00

au0828_v4l2_close() check for dev_state == DEV_DISCONNECTED will fail to
detect the device disconnected state correctly, if au0828_v4l2_open() runs
to set the DEV_INITIALIZED bit. A loop test of bind/unbind found this bug
by increasing the likelihood of au0828_v4l2_open() occurring while unbind
is in progress. When au0828_v4l2_close() fails to detect that the device
is in disconnect state, it attempts to power down the device and fails with
the following general protection fault:

[  260.992962] Call Trace:
[  260.993008]  [] ? xc5000_sleep+0x8f/0xd0 [xc5000]
[  260.993095]  [] ? fe_standby+0x3c/0x50 [tuner]
[  260.993186]  [] au0828_v4l2_close+0x53c/0x620 [au0828]
[  260.993298]  [] v4l2_release+0xf0/0x210 [videodev]
[  260.993382]  [] __fput+0x1fc/0x6c0
[  260.993449]  [] ____fput+0xe/0x10
[  260.993519]  [] task_work_run+0x133/0x1f0
[  260.993602]  [] exit_to_usermode_loop+0x140/0x170
[  260.993681]  [] syscall_return_slowpath+0x16a/0x1a0
[  260.993754]  [] entry_SYSCALL_64_fastpath+0xa6/0xa8

Cc: stable@vger.kernel.org
Signed-off-by: Shuah Khan 
Signed-off-by: Mauro Carvalho Chehab

[media] media: au0828 fix to clear enable/disable/change source handlers

2016-03-31T17:50:39+00:00

Fix to clear enable/disable/change source handlers in the media device
when media device is unregistered in au0828_unregister_media_device().
When au0828 module is removed, snd-usb-audio shouldn't call the handlers.
Clearing will ensure snd-usb-audio won't call them once au0828 is removed.

[mchehab@osg.samsung.com: fix a compilation breakage]
Signed-off-by: Shuah Khan 
Signed-off-by: Mauro Carvalho Chehab

[media] au0828: disable tuner links and cache tuner/decoder

2016-03-31T17:50:38+00:00

For au0828_enable_source() to work, the tuner links should be
disabled and the tuner/decoder should be cached at au0828 struct.

While here, put dev->decoder cache together with dev->tuner, as
it makes easier to drop both latter if/when we move the enable
routines to the V4L2 core.

Fixes: 9822f4173f84 ('[media] au0828: use v4l2_mc_create_media_graph()')

Signed-off-by: Mauro Carvalho Chehab 
Reviewed-by: Shuah Khan 
Tested-by: Shuah Khan

media: au0828 disable tuner to demod link in au0828_media_device_register()

2016-03-10T16:44:10+00:00

Disable tuner to demod link in au0828_media_device_register(). This step
should be done after dvb graph is created.

[mchehab@osg.samsung.com: Solve conflictst to apply it upstream]
Signed-off-by: Shuah Khan 
Signed-off-by: Mauro Carvalho Chehab

[media] touptek: cast char types on %x printk

2016-03-10T16:37:45+00:00

This fixes those two smatch warnings:
	drivers/media/usb/gspca/touptek.c:206 val_reply() warn: argument 3 to %02x specifier has type 'char'
	drivers/media/usb/gspca/touptek.c:222 reg_w() warn: argument 4 to %02x specifier has type 'char'

Signed-off-by: Mauro Carvalho Chehab