kernel/drivers/media/usb/dvb-usb/digitv.c, branch linux-6.9.y

media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()

2023-05-14T05:30:06Z

In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach digitv_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Link: https://lore.kernel.org/linux-media/20230313095008.1039689-1-harperchen1110@gmail.com Signed-off-by: Wei Chen Signed-off-by: Mauro Carvalho Chehab

media: digitv: use the newer dvb-usb macros for USB device

2022-04-18T05:36:43Z

In order to make the drivers under dvb-usb more homogeneous, use the new macro. Link: https://lore.kernel.org/linux-media/68de8820a361e61c25bf7402acac71b3770ff906.1648499509.git.mchehab@kernel.org Signed-off-by: Mauro Carvalho Chehab

media: dvb-usb: make dvb_usb_device_properties const

2020-04-21T10:56:10Z

This makes it possible to declare dvb_usb_device_properties const. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: dvb: digitv: remove unused array element 0

2020-04-21T10:53:53Z

The first element of the key array is not used. Remove it, and along with it a uninitialized memory read. This should fix the rc debug message. Link: https://www.spinics.net/lists/kernel/msg3374861.html Suggested-by: Phong Tran Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

media: docs: move driver-specific info to driver-api

2020-04-14T08:36:18Z

Those documents don't really describe the driver API. Instead, they contain development-specific information. Yet, as the main index file describes the content of it as: "how specific kernel subsystems work from the point of view of a kernel developer" It seems to be the better fit. Signed-off-by: Mauro Carvalho Chehab

media: digitv: don't continue if remote control state can't be read

2020-01-03T15:00:33Z

This results in an uninitialized variable read. Reported-by: syzbot+6bf9606ee955b646c0e1@syzkaller.appspotmail.com Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 372

2019-06-05T15:37:10Z

Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation version 2 extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 135 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190531081036.435762997@linutronix.de Signed-off-by: Greg Kroah-Hartman

media: dvb: point to the location of the old README.dvb-usb file

2018-06-15T21:10:01Z

This file got renamed, but the references still point to the old place. Signed-off-by: Mauro Carvalho Chehab Acked-by: Jonathan Corbet

[media] digitv: limit messages to buffer size

2017-04-18T15:52:41Z

Return an error rather than memcpy()ing beyond the end of the buffer. Internal callers use appropriate sizes, but digitv_i2c_xfer may not. Signed-off-by: Alyssa Milburn Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab

[media] digitv: handle error code on RC query

2016-10-14T15:52:27Z

There's no sense on decoding and generating a RC key code if there was an error on the URB control message. Signed-off-by: Mauro Carvalho Chehab