kevin/linux
1
Fork 0
Code
d595d423d0
linux/include/media
History
Prabhakar Lad b25db38392 media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS 
drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons:

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-07-26 06:14:33 -04:00
..
blackfin [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
davinci media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS 2017-07-26 06:14:33 -04:00
drv-intf [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
i2c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
cec-notifier.h media: cec-notifier: small improvements 2017-07-26 05:46:44 -04:00
cec.h Linux 4.12-rc6 2017-06-20 08:51:56 -03:00
i2c-addr.h
imx.h [media] media: Add i.MX media core driver 2017-06-20 07:30:38 -03:00
lirc_dev.h [media] lirc_dev: cleanup header 2017-06-06 09:07:26 -03:00
lirc.h
media-device.h [media] media: Protect enable_source and disable_source handler code paths 2017-02-03 07:39:35 -02:00
media-devnode.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
media-entity.h [media] media: entity: Add media_entity_get_fwnode_pad() function 2017-06-20 09:09:37 -03:00
rc-core.h [media] rc-core: cleanup rc_register_device pt2 2017-06-13 13:55:01 -03:00
rc-map.h [media] mce_kbd: add encoder 2017-03-24 08:24:41 -03:00
rcar-fcp.h v4l: rcar-fcp: Add an API to retrieve the FCP device 2017-06-09 12:25:36 +01:00
soc_camera.h [media] v4l: soc-camera: Remove videobuf1 support 2017-03-22 11:27:24 -03:00
tuner-types.h [media] doc-rst: Fix conversion for v4l2 core functions 2016-07-17 14:02:43 -03:00
tuner.h [media] v4l2-mc.h: move tuner PAD definitions to this new header 2016-02-01 07:19:44 -02:00
tveeprom.h [media] tveeprom: get rid of documentation of an unused parameter 2017-04-05 15:37:06 -03:00
v4l2-async.h [media] v4l: Switch from V4L2 OF not V4L2 fwnode API 2017-06-06 09:58:16 -03:00
v4l2-clk.h
v4l2-common.h [media] v4l2-common: add a debug macro to be used with dev_foo() 2016-11-18 10:04:58 -02:00
v4l2-ctrls.h [media] v4l2-ctrls.c: Implement unlocked variant of v4l2_ctrl_handler_setup() 2017-06-07 08:38:12 -03:00
v4l2-dev.h [media] get rid of a number of problems at the cross references 2016-09-22 10:00:23 -03:00
v4l2-device.h [media] v4l2-device.h: fix some doc tags 2016-09-09 09:41:12 -03:00
v4l2-dv-timings.h [media] v4l2-dv-timings: add helpers for vic and pixelaspect ratio 2016-11-16 15:20:03 -02:00
v4l2-event.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
v4l2-fh.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
v4l2-flash-led-class.h [media] v4l: flash led class: Use fwnode_handle instead of device_node in init 2017-06-06 09:27:51 -03:00
v4l2-fwnode.h [media] v4l: fwnode: Support generic fwnode for parsing standardised properties 2017-06-06 09:25:16 -03:00
v4l2-image-sizes.h
v4l2-ioctl.h [media] v4l: Add metadata buffer type and format 2017-04-14 22:37:02 -03:00
v4l2-mc.h [media] get rid of a number of problems at the cross references 2016-09-22 10:00:23 -03:00
v4l2-mediabus.h
v4l2-mem2mem.h [media] media: v4l2-mem2mem: extend m2m APIs for more accurate buffer management 2017-06-20 08:53:39 -03:00
v4l2-rect.h [media] v4l2-rect.h: new header with struct v4l2_rect helper functions 2016-04-20 16:11:33 -03:00
v4l2-subdev.h [media] v4l: subdev: tolerate null in media_entity_to_v4l2_subdev 2017-06-08 16:55:25 -03:00
v4l2-tpg-colors.h [media] tpg: Export the tpg code from vivid as a module 2016-04-20 16:14:39 -03:00
v4l2-tpg.h [media] vivid: Add support for HSV encoding 2016-10-21 15:54:16 -02:00
videobuf2-core.h [media] vb2: Fix queue_setup() callback description 2017-04-05 15:11:07 -03:00
videobuf2-dma-contig.h dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
videobuf2-dma-sg.h [media] vb2: replace void *alloc_ctxs by struct device *alloc_devs 2016-07-08 14:45:07 -03:00
videobuf2-dvb.h [media] add media controller support to videobuf2-dvb 2016-02-10 07:23:41 -02:00
videobuf2-memops.h [media] vb2: convert vb2_vmarea_handler refcount from atomic_t to refcount_t 2017-04-05 15:31:57 -03:00
videobuf2-v4l2.h [media] videobuf2-v4l2: document two helper functions 2016-09-09 10:19:06 -03:00
videobuf2-vmalloc.h
videobuf-core.h
videobuf-dma-contig.h
videobuf-dma-sg.h
videobuf-dvb.h
videobuf-vmalloc.h
vsp1.h v4l: vsp1: Add API to map and unmap DRM buffers through the VSP 2017-06-09 12:25:38 +01:00