kernel/git/stable/linux.git/drivers/media/usb, branch linux-6.0.y

media: dvb-usb: fix memory leak in dvb_usb_adapter_init()

2022-12-31T12:26:45+00:00

[ Upstream commit 94d90fb06b94a90c176270d38861bcba34ce377d ] Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] call_driver_probe drivers/base/dd.c:542 [inline] [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [] really_probe drivers/base/dd.c:583 [inline] [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [] __device_attach+0x122/0x260 drivers/base/dd.c:970 [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [] call_driver_probe drivers/base/dd.c:542 [inline] [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [] really_probe drivers/base/dd.c:583 [inline] [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com Signed-off-by: Mazin Al Haddad Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()

2022-12-31T12:26:03+00:00

[ Upstream commit 0ed554fd769a19ea8464bb83e9ac201002ef74ad ] Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") Reported-by: Wei Chen Signed-off-by: Baisong Zhong Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: uvcvideo: Use entity get_cur in uvc_ctrl_set

2022-10-21T10:38:41+00:00

[ Upstream commit 5f36851c36b30f713f588ed2b60aa7b4512e2c76 ] Entity controls should get_cur using an entity-defined function instead of via a query. Fix this in uvc_ctrl_set. Fixes: 65900c581d01 ("media: uvcvideo: Allow entity-defined get_info and get_cur") Signed-off-by: Yunke Cao Reviewed-by: Ricardo Ribalda Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: uvcvideo: Fix memory leak in uvc_gpio_parse

2022-10-21T10:38:41+00:00

[ Upstream commit f0f078457f18f10696888f8d0e6aba9deb9cde92 ] Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate the unit buffer after the IRQ to avoid it. Addresses-Coverity-ID: 1474639 ("Resource leak") Fixes: 2886477ff987 ("media: uvcvideo: Implement UVC_EXT_GPIO_UNIT") Signed-off-by: José Expósito Reviewed-by: Ricardo Ribalda Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

media: airspy: fix memory leak in airspy probe

2022-10-21T10:38:40+00:00

[ Upstream commit 23bc5eb55f8c9607965c20d9ddcc13cb1ae59568 ] The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing deallocation in the success path. Fix this by freeing buf in the success path since this variable does not have any references in other code. Fixes: ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") Reported-by: syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu Reviewed-by: Tommaso Merciai Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin

Merge tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2022-10-01T16:27:18+00:00

Pull media fixes from Mauro Carvalho Chehab: - some fixes for the v4l2 ioctl handler logic - a fix for an out of bound access in the DVB videobuf2 handler - three driver fixes (rkvdec, mediatek/vcodek and uvcvideo) * tag 'media/v6.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: rkvdec: Disable H.264 error detection media: mediatek: vcodec: Drop platform_get_resource(IORESOURCE_IRQ) media: dvb_vb2: fix possible out of bound access media: v4l2-ioctl.c: fix incorrect error path media: v4l2-compat-ioctl32.c: zero buffer passed to v4l2_compat_get_array_args() media: uvcvideo: Fix InterfaceProtocol for Quanta camera

media: flexcop-usb: fix endpoint type check

2022-09-22T08:40:57+00:00

Commit d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type") tried to add an endpoint type sanity check for the single isochronous endpoint but instead broke the driver by checking the wrong descriptor or random data beyond the last endpoint descriptor. Make sure to check the right endpoint descriptor. Fixes: d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type") Cc: Oliver Neukum Cc: stable@vger.kernel.org # 5.9 Reported-by: Dongliang Mu Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220822151027.27026-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman

media: uvcvideo: Fix InterfaceProtocol for Quanta camera

2022-08-31T08:19:47+00:00

The Quanta 0408:4034 camera implements UVC 1.5, and thus sets bInterfaceProtocol to UVC_PC_PROTOCOL_15. Commit 95f03d973478 ("media: uvcvideo: Limit power line control for Quanta cameras") added a quirk for the device that incorrectly specified the UVC 1.0 protocol, rendering the quirk inoperative. Fix it. Link: https://lore.kernel.org/linux-media/20220822131754.102393-1-ribalda@chromium.org Fixes: 95f03d973478 ("media: uvcvideo: Limit power line control for Quanta cameras") Reviewed-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab

media: uvcvideo: Fix invalid pointer in uvc_ctrl_init_ctrl()

2022-07-27T18:25:59+00:00

The handling of per-device mappings introduced in commit 86f7ef773156 ("media: uvcvideo: Add support for per-device control mapping overrides") overwrote the mapping variable after it was initialized and before it was used, leading to usage of an invalid pointer for devices with per-device mappings. Fix it. Fixes: 86f7ef773156 ("media: uvcvideo: Add support for per-device control mapping overrides") Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab

media: uvcvideo: Remove unneeded goto

2022-07-16T07:53:22+00:00

The goto statement in uvc_v4l2_try_format can simply be replaced by an direct return. There is no further user of the label, so remove it. Signed-off-by: Michael Grzeschik Reviewed-by: Paul Elder Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab