Update to 4.15.4
Drop media-dvb-usb-v2-lmedm04-Improve-logic-checking-of-w.patch Drop media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch Drop media-hdpvr-fix-an-error-handling-path-in-hdpvr_prob.patch Cleanup Debian changelog for 4.15.4
This commit is contained in:
Salvatore Bonaccorso
parent
4cb4e4a1d6
commit
fc2cf56edb
|
|
@ -1,4 +1,4 @@
|
|||
linux (4.15.3-1~exp1) UNRELEASED; urgency=medium
|
||||
linux (4.15.4-1~exp1) UNRELEASED; urgency=medium
|
||||
|
||||
* New upstream release: https://kernelnewbies.org/Linux_4.15
|
||||
* New upstream stable update:
|
||||
|
|
@ -97,6 +97,208 @@ linux (4.15.3-1~exp1) UNRELEASED; urgency=medium
|
|||
- net_sched: get rid of rcu_barrier() in tcf_block_put_ext()
|
||||
- net: sched: fix use-after-free in tcf_block_put_ext
|
||||
- crypto: tcrypt - fix S/G table for test_aead_speed()
|
||||
* New upstream stable update:
|
||||
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.15.4
|
||||
- cifs: Fix missing put_xid in cifs_file_strict_mmap
|
||||
- cifs: Fix autonegotiate security settings mismatch
|
||||
- CIFS: zero sensitive data when freeing
|
||||
- cpufreq: mediatek: add mediatek related projects into blacklist
|
||||
- [arm64] watchdog: gpio_wdt: set WDOG_HW_RUNNING in gpio_wdt_stop
|
||||
- Revert "drm/i915: mark all device info struct with __initconst"
|
||||
- sched/rt: Use container_of() to get root domain in
|
||||
rto_push_irq_work_func()
|
||||
- sched/rt: Up the root domain ref count when passing it around via IPIs
|
||||
- [arm64] mm: Use non-global mappings for kernel space
|
||||
- [arm64] mm: Temporarily disable ARM64_SW_TTBR0_PAN
|
||||
- [arm64] mm: Move ASID from TTBR0 to TTBR1
|
||||
- [arm64] mm: Remove pre_ttbr0_update_workaround for Falkor erratum #E1003
|
||||
- [arm64] mm: Rename post_ttbr0_update_workaround
|
||||
- [arm64] mm: Fix and re-enable ARM64_SW_TTBR0_PAN
|
||||
- [arm64] mm: Allocate ASIDs in pairs
|
||||
- [arm64] mm: Add arm64_kernel_unmapped_at_el0 helper
|
||||
- [arm64] mm: Invalidate both kernel and user ASIDs when performing TLBI
|
||||
- [arm64] entry: Add exception trampoline page for exceptions from EL0
|
||||
- [arm64] mm: Map entry trampoline into trampoline and kernel page tables
|
||||
- [arm64] entry: Explicitly pass exception level to kernel_ventry macro
|
||||
- [arm64] entry: Hook up entry trampoline to exception vectors
|
||||
- [arm64] erratum: Work around Falkor erratum #E1003 in trampoline code
|
||||
- [arm64] cpu_errata: Add Kryo to Falkor 1003 errata
|
||||
- [arm64] tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks
|
||||
- [arm64] entry: Add fake CPU feature for unmapping the kernel at EL0
|
||||
- [arm64] kaslr: Put kernel vectors address in separate data page
|
||||
- [arm64] use RET instruction for exiting the trampoline
|
||||
- [arm64] Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0
|
||||
- [arm64] Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry
|
||||
- [arm64] Take into account ID_AA64PFR0_EL1.CSV3
|
||||
- [arm64] capabilities: Handle duplicate entries for a capability
|
||||
- [arm64] mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR
|
||||
- [arm64] kpti: Fix the interaction between ASID switching and software PAN
|
||||
- [arm64] cputype: Add MIDR values for Cavium ThunderX2 CPUs
|
||||
- [arm64] Turn on KPTI only on CPUs that need it
|
||||
- [arm64] kpti: Make use of nG dependent on arm64_kernel_unmapped_at_el0()
|
||||
- [arm64] mm: Permit transitioning from Global to Non-Global without BBM
|
||||
- [arm64] kpti: Add ->enable callback to remap swapper using nG mappings
|
||||
- [arm64] Force KPTI to be disabled on Cavium ThunderX
|
||||
- [arm64] entry: Reword comment about post_ttbr_update_workaround
|
||||
- [arm64] idmap: Use "awx" flags for .idmap.text .pushsection directives
|
||||
- [arm64] barrier: Add CSDB macros to control data-value prediction
|
||||
- [arm64] Implement array_index_mask_nospec()
|
||||
- [arm64] Make USER_DS an inclusive limit
|
||||
- [arm64] Use pointer masking to limit uaccess speculation
|
||||
- [arm64] entry: Ensure branch through syscall table is bounded under
|
||||
speculation
|
||||
- [arm64] uaccess: Prevent speculative use of the current addr_limit
|
||||
- [arm64] uaccess: Don't bother eliding access_ok checks in __{get,
|
||||
put}_user
|
||||
- [arm64] uaccess: Mask __user pointers for __arch_{clear, copy_*}_user
|
||||
- [arm64] futex: Mask __user pointers prior to dereference
|
||||
- [arm64] cpufeature: __this_cpu_has_cap() shouldn't stop early
|
||||
- [arm64] Run enable method for errata work arounds on late CPUs
|
||||
- [arm64] cpufeature: Pass capability structure to ->enable callback
|
||||
- drivers/firmware: Expose psci_get_version through psci_ops structure
|
||||
- [arm64] Move post_ttbr_update_workaround to C code
|
||||
- [arm64] Add skeleton to harden the branch predictor against aliasing
|
||||
attacks
|
||||
- [arm64] Move BP hardening to check_and_switch_context
|
||||
- [arm64] KVM: Use per-CPU vector when BP hardening is enabled
|
||||
- [arm64] entry: Apply BP hardening for high-priority synchronous
|
||||
exceptions
|
||||
- [arm64] entry: Apply BP hardening for suspicious interrupts from EL0
|
||||
- [arm64] cputype: Add missing MIDR values for Cortex-A72 and Cortex-A75
|
||||
- [arm64] Implement branch predictor hardening for affected Cortex-A CPUs
|
||||
- [arm64] Implement branch predictor hardening for Falkor
|
||||
- [arm64] Branch predictor hardening for Cavium ThunderX2
|
||||
- [arm64] KVM: Increment PC after handling an SMC trap
|
||||
- [armhf,arm64] KVM: Consolidate the PSCI include files
|
||||
- [armhf,arm64] KVM: Add PSCI_VERSION helper
|
||||
- [armhf,arm64] KVM: Add smccc accessors to PSCI code
|
||||
- [armhf,arm64] KVM: Implement PSCI 1.0 support
|
||||
- [armhf,arm64] KVM: Advertise SMCCC v1.1
|
||||
- [arm64] KVM: Make PSCI_VERSION a fast path
|
||||
- [armhf,arm64] KVM: Turn kvm_psci_version into a static inline
|
||||
- [arm64] KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
|
||||
- [arm64] KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
|
||||
- firmware/psci: Expose PSCI conduit
|
||||
- firmware/psci: Expose SMCCC version through psci_ops
|
||||
- arm/arm64: smccc: Make function identifiers an unsigned quantity
|
||||
- arm/arm64: smccc: Implement SMCCC v1.1 inline primitive
|
||||
- [arm64] Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
|
||||
- [arm64] Kill PSCI_GET_VERSION as a variant-2 workaround
|
||||
- mtd: cfi: convert inline functions to macros
|
||||
- mtd: nand: brcmnand: Disable prefetch by default
|
||||
- mtd: nand: Fix nand_do_read_oob() return value
|
||||
- mtd: nand: sunxi: Fix ECC strength choice
|
||||
- ubi: Fix race condition between ubi volume creation and udev
|
||||
- ubi: fastmap: Erase outdated anchor PEBs during attach
|
||||
- ubi: block: Fix locking for idr_alloc/idr_remove
|
||||
- ubifs: free the encrypted symlink target
|
||||
- nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds
|
||||
- nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE
|
||||
- NFS: Add a cond_resched() to nfs_commit_release_pages()
|
||||
- NFS: Fix nfsstat breakage due to LOOKUPP
|
||||
- NFS: commit direct writes even if they fail partially
|
||||
- NFS: reject request for id_legacy key without auxdata
|
||||
- NFS: Fix a race between mmap() and O_DIRECT
|
||||
- nfsd: Detect unhashed stids in nfsd4_verify_open_stid()
|
||||
- kernfs: fix regression in kernfs_fop_write caused by wrong type
|
||||
- ahci: Annotate PCI ids for mobile Intel chipsets as such
|
||||
- ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI
|
||||
- ahci: Add Intel Cannon Lake PCH-H PCI ID
|
||||
- crypto: hash - introduce crypto_hash_alg_has_setkey()
|
||||
- crypto: cryptd - pass through absence of ->setkey()
|
||||
- crypto: mcryptd - pass through absence of ->setkey()
|
||||
- crypto: poly1305 - remove ->setkey() method
|
||||
- crypto: hash - annotate algorithms taking optional key
|
||||
- crypto: hash - prevent using keyed hashes without setting key
|
||||
- media: v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt
|
||||
- media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
|
||||
- media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
|
||||
- media: v4l2-compat-ioctl32.c: fix the indentation
|
||||
- media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32
|
||||
- media: v4l2-compat-ioctl32.c: avoid sizeof(type)
|
||||
- media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
|
||||
- media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
|
||||
- media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
|
||||
- media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
|
||||
- media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
|
||||
- media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
|
||||
- media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
|
||||
- crypto: caam - fix endless loop when DECO acquire fails
|
||||
- crypto: sha512-mb - initialize pending lengths correctly
|
||||
- crypto: talitos - fix Kernel Oops on hashing an empty file
|
||||
- [armhf,arm64 KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
|
||||
- [x86] KVM: nVMX: Fix races when sending nested PI while dest
|
||||
enters/leaves L2
|
||||
- [x86] KVM: nVMX: Fix bug of injecting L2 exception into L1
|
||||
- [powerpc*] KVM: PPC: Book3S HV: Make sure we don't re-enter guest
|
||||
without XIVE loaded
|
||||
- [powerpc*] KVM: PPC: Book3S HV: Drop locks before reading guest memory
|
||||
- [armhf,arm64] KVM: Handle CPU_PM_ENTER_FAILED
|
||||
- [powerpc*] KVM: PPC: Book3S PR: Fix broken select due to misspelling
|
||||
- watchdog: imx2_wdt: restore previous timeout after suspend+resume
|
||||
- afs: Add missing afs_put_cell()
|
||||
- afs: Need to clear responded flag in addr cursor
|
||||
- afs: Fix missing cursor clearance
|
||||
- afs: Fix server list handling
|
||||
- btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker
|
||||
- Btrfs: raid56: iterate raid56 internal bio with bio_for_each_segment_all
|
||||
- kasan: don't emit builtin calls when sanitization is off
|
||||
- kasan: rework Kconfig settings
|
||||
- media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return
|
||||
code
|
||||
- media: dvb-frontends: fix i2c access helpers for KASAN
|
||||
- media: dt-bindings/media/cec-gpio.txt: mention the CEC/HPD max voltages
|
||||
- media: ts2020: avoid integer overflows on 32 bit machines
|
||||
- media: vivid: fix module load error when enabling fb and no_error_inj=1
|
||||
- media: cxusb, dib0700: ignore XC2028_I2C_FLUSH
|
||||
- fs/proc/kcore.c: use probe_kernel_read() instead of memcpy()
|
||||
- kernel/async.c: revert "async: simplify lowest_in_progress()"
|
||||
- kernel/relay.c: revert "kernel/relay.c: fix potential memory leak"
|
||||
- pipe: actually allow root to exceed the pipe buffer limits
|
||||
- pipe: fix off-by-one error when checking buffer limits
|
||||
- HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working
|
||||
- Bluetooth: btsdio: Do not bind to non-removable BCM43341
|
||||
- Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
|
||||
- Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten"
|
||||
version
|
||||
- ipmi: use dynamic memory for DMI driver override
|
||||
- signal/openrisc: Fix do_unaligned_access to send the proper signal
|
||||
- signal/sh: Ensure si_signo is initialized in do_divide_error
|
||||
- alpha: fix crash if pthread_create races with signal delivery
|
||||
- alpha: osf_sys.c: fix put_tv32 regression
|
||||
- alpha: Fix mixed up args in EXC macro in futex operations
|
||||
- alpha: fix reboot on Avanti platform
|
||||
- alpha: fix formating of stack content
|
||||
- xtensa: fix futex_atomic_cmpxchg_inatomic
|
||||
- EDAC, octeon: Fix an uninitialized variable warning
|
||||
- genirq: Make legacy autoprobing work again
|
||||
- pinctrl: intel: Initialize GPIO properly when used through irqchip
|
||||
- pinctrl: mcp23s08: fix irq setup order
|
||||
- pinctrl: sx150x: Unregister the pinctrl on release
|
||||
- pinctrl: sx150x: Register pinctrl before adding the gpiochip
|
||||
- pinctrl: sx150x: Add a static gpio/pinctrl pin range mapping
|
||||
- pktcdvd: Fix pkt_setup_dev() error path
|
||||
- pktcdvd: Fix a recently introduced NULL pointer dereference
|
||||
- blk-mq: quiesce queue before freeing queue
|
||||
- clocksource/drivers/stm32: Fix kernel panic with multiple timers
|
||||
- lib/ubsan.c: s/missaligned/misaligned/
|
||||
- lib/ubsan: add type mismatch handler for new GCC/Clang
|
||||
- objtool: Fix switch-table detection
|
||||
- [arm64] dts: marvell: add Ethernet aliases
|
||||
- drm/i915: Avoid PPS HW/SW state mismatch due to rounding
|
||||
- ACPI: sbshc: remove raw pointer from printk() message
|
||||
- acpi, nfit: fix register dimm error handling
|
||||
- ovl: force r/o mount when index dir creation fails
|
||||
- ovl: fix failure to fsync lower dir
|
||||
- ovl: take mnt_want_write() for work/index dir setup
|
||||
- ovl: take mnt_want_write() for removing impure xattr
|
||||
- ovl: hash directory inodes for fsnotify
|
||||
- devpts: fix error handling in devpts_mntget()
|
||||
- ftrace: Remove incorrect setting of glob search field
|
||||
- scsi: core: Ensure that the SCSI error handler gets woken up
|
||||
- scsi: lpfc: Fix crash after bad bar setup on driver attachment
|
||||
- scsi: cxlflash: Reset command ioasc
|
||||
- rcu: Export init_rcu_head() and destroy_rcu_head() to GPL modules
|
||||
|
||||
[ Bastian Blank ]
|
||||
* Add cloud-amd64 kernel flavour.
|
||||
|
|
|
|||
|
|
@ -1,83 +0,0 @@
|
|||
From: Malcolm Priestley <tvboxspy@gmail.com>
|
||||
Date: Tue, 26 Sep 2017 17:10:20 -0400
|
||||
Subject: [1/2] media: dvb-usb-v2: lmedm04: Improve logic checking of warm
|
||||
start
|
||||
Origin: https://git.linuxtv.org/media_tree.git/commit?id=3d932ee27e852e4904647f15b64dedca51187ad7
|
||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16538
|
||||
|
||||
Warm start has no check as whether a genuine device has
|
||||
connected and proceeds to next execution path.
|
||||
|
||||
Check device should read 0x47 at offset of 2 on USB descriptor read
|
||||
and it is the amount requested of 6 bytes.
|
||||
|
||||
Fix for
|
||||
kasan: CONFIG_KASAN_INLINE enabled
|
||||
kasan: GPF could be caused by NULL-ptr deref or user memory access as
|
||||
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
|
||||
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
||||
---
|
||||
drivers/media/usb/dvb-usb-v2/lmedm04.c | 26 ++++++++++++++++++--------
|
||||
1 file changed, 18 insertions(+), 8 deletions(-)
|
||||
|
||||
--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
|
||||
+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
|
||||
@@ -494,18 +494,23 @@ static int lme2510_pid_filter(struct dvb
|
||||
|
||||
static int lme2510_return_status(struct dvb_usb_device *d)
|
||||
{
|
||||
- int ret = 0;
|
||||
+ int ret;
|
||||
u8 *data;
|
||||
|
||||
- data = kzalloc(10, GFP_KERNEL);
|
||||
+ data = kzalloc(6, GFP_KERNEL);
|
||||
if (!data)
|
||||
return -ENOMEM;
|
||||
|
||||
- ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
|
||||
- 0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200);
|
||||
- info("Firmware Status: %x (%x)", ret , data[2]);
|
||||
+ ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0),
|
||||
+ 0x06, 0x80, 0x0302, 0x00,
|
||||
+ data, 0x6, 200);
|
||||
+ if (ret != 6)
|
||||
+ ret = -EINVAL;
|
||||
+ else
|
||||
+ ret = data[2];
|
||||
+
|
||||
+ info("Firmware Status: %6ph", data);
|
||||
|
||||
- ret = (ret < 0) ? -ENODEV : data[2];
|
||||
kfree(data);
|
||||
return ret;
|
||||
}
|
||||
@@ -1189,6 +1194,7 @@ static int lme2510_get_adapter_count(str
|
||||
static int lme2510_identify_state(struct dvb_usb_device *d, const char **name)
|
||||
{
|
||||
struct lme2510_state *st = d->priv;
|
||||
+ int status;
|
||||
|
||||
usb_reset_configuration(d->udev);
|
||||
|
||||
@@ -1197,12 +1203,16 @@ static int lme2510_identify_state(struct
|
||||
|
||||
st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware;
|
||||
|
||||
- if (lme2510_return_status(d) == 0x44) {
|
||||
+ status = lme2510_return_status(d);
|
||||
+ if (status == 0x44) {
|
||||
*name = lme_firmware_switch(d, 0);
|
||||
return COLD;
|
||||
}
|
||||
|
||||
- return 0;
|
||||
+ if (status != 0x47)
|
||||
+ return -EINVAL;
|
||||
+
|
||||
+ return WARM;
|
||||
}
|
||||
|
||||
static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type,
|
||||
|
|
@ -1,67 +0,0 @@
|
|||
From: Malcolm Priestley <tvboxspy@gmail.com>
|
||||
Date: Tue, 26 Sep 2017 17:10:21 -0400
|
||||
Subject: [2/2] media: dvb-usb-v2: lmedm04: move ts2020 attach to
|
||||
dm04_lme2510_tuner
|
||||
Origin: https://git.linuxtv.org/media_tree.git/commit?id=7bf7a7116ed313c601307f7e585419369926ab05
|
||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16538
|
||||
|
||||
When the tuner was split from m88rs2000 the attach function is in wrong
|
||||
place.
|
||||
|
||||
Move to dm04_lme2510_tuner to trap errors on failure and removing
|
||||
a call to lme_coldreset.
|
||||
|
||||
Prevents driver starting up without any tuner connected.
|
||||
|
||||
Fixes to trap for ts2020 fail.
|
||||
LME2510(C): FE Found M88RS2000
|
||||
ts2020: probe of 0-0060 failed with error -11
|
||||
...
|
||||
LME2510(C): TUN Found RS2000 tuner
|
||||
kasan: CONFIG_KASAN_INLINE enabled
|
||||
kasan: GPF could be caused by NULL-ptr deref or user memory access
|
||||
general protection fault: 0000 [#1] PREEMPT SMP KASAN
|
||||
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
|
||||
Tested-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
||||
---
|
||||
drivers/media/usb/dvb-usb-v2/lmedm04.c | 13 ++++++-------
|
||||
1 file changed, 6 insertions(+), 7 deletions(-)
|
||||
|
||||
--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
|
||||
+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
|
||||
@@ -1076,8 +1076,6 @@ static int dm04_lme2510_frontend_attach(
|
||||
|
||||
if (adap->fe[0]) {
|
||||
info("FE Found M88RS2000");
|
||||
- dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config,
|
||||
- &d->i2c_adap);
|
||||
st->i2c_tuner_gate_w = 5;
|
||||
st->i2c_tuner_gate_r = 5;
|
||||
st->i2c_tuner_addr = 0x60;
|
||||
@@ -1143,17 +1141,18 @@ static int dm04_lme2510_tuner(struct dvb
|
||||
ret = st->tuner_config;
|
||||
break;
|
||||
case TUNER_RS2000:
|
||||
- ret = st->tuner_config;
|
||||
+ if (dvb_attach(ts2020_attach, adap->fe[0],
|
||||
+ &ts2020_config, &d->i2c_adap))
|
||||
+ ret = st->tuner_config;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
- if (ret)
|
||||
+ if (ret) {
|
||||
info("TUN Found %s tuner", tun_msg[ret]);
|
||||
- else {
|
||||
- info("TUN No tuner found --- resetting device");
|
||||
- lme_coldreset(d);
|
||||
+ } else {
|
||||
+ info("TUN No tuner found");
|
||||
return -ENODEV;
|
||||
}
|
||||
|
||||
|
|
@ -1,98 +0,0 @@
|
|||
From: Arvind Yadav <arvind.yadav.cs@gmail.com>
|
||||
Date: Fri, 22 Sep 2017 09:07:06 -0400
|
||||
Subject: media: hdpvr: Fix an error handling path in hdpvr_probe()
|
||||
Origin: https://git.linuxtv.org/media_tree.git/commit?id=c0f71bbb810237a38734607ca4599632f7f5d47f
|
||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-16644
|
||||
|
||||
Here, hdpvr_register_videodev() is responsible for setup and
|
||||
register a video device. Also defining and initializing a worker.
|
||||
hdpvr_register_videodev() is calling by hdpvr_probe at last.
|
||||
So no need to flush any work here.
|
||||
Unregister v4l2, free buffers and memory. If hdpvr_probe() will fail.
|
||||
|
||||
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Tested-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
|
||||
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
|
||||
---
|
||||
drivers/media/usb/hdpvr/hdpvr-core.c | 26 +++++++++++++++-----------
|
||||
1 file changed, 15 insertions(+), 11 deletions(-)
|
||||
|
||||
--- a/drivers/media/usb/hdpvr/hdpvr-core.c
|
||||
+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
|
||||
@@ -292,7 +292,7 @@ static int hdpvr_probe(struct usb_interf
|
||||
/* register v4l2_device early so it can be used for printks */
|
||||
if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) {
|
||||
dev_err(&interface->dev, "v4l2_device_register failed\n");
|
||||
- goto error;
|
||||
+ goto error_free_dev;
|
||||
}
|
||||
|
||||
mutex_init(&dev->io_mutex);
|
||||
@@ -301,7 +301,7 @@ static int hdpvr_probe(struct usb_interf
|
||||
dev->usbc_buf = kmalloc(64, GFP_KERNEL);
|
||||
if (!dev->usbc_buf) {
|
||||
v4l2_err(&dev->v4l2_dev, "Out of memory\n");
|
||||
- goto error;
|
||||
+ goto error_v4l2_unregister;
|
||||
}
|
||||
|
||||
init_waitqueue_head(&dev->wait_buffer);
|
||||
@@ -339,13 +339,13 @@ static int hdpvr_probe(struct usb_interf
|
||||
}
|
||||
if (!dev->bulk_in_endpointAddr) {
|
||||
v4l2_err(&dev->v4l2_dev, "Could not find bulk-in endpoint\n");
|
||||
- goto error;
|
||||
+ goto error_put_usb;
|
||||
}
|
||||
|
||||
/* init the device */
|
||||
if (hdpvr_device_init(dev)) {
|
||||
v4l2_err(&dev->v4l2_dev, "device init failed\n");
|
||||
- goto error;
|
||||
+ goto error_put_usb;
|
||||
}
|
||||
|
||||
mutex_lock(&dev->io_mutex);
|
||||
@@ -353,7 +353,7 @@ static int hdpvr_probe(struct usb_interf
|
||||
mutex_unlock(&dev->io_mutex);
|
||||
v4l2_err(&dev->v4l2_dev,
|
||||
"allocating transfer buffers failed\n");
|
||||
- goto error;
|
||||
+ goto error_put_usb;
|
||||
}
|
||||
mutex_unlock(&dev->io_mutex);
|
||||
|
||||
@@ -361,7 +361,7 @@ static int hdpvr_probe(struct usb_interf
|
||||
retval = hdpvr_register_i2c_adapter(dev);
|
||||
if (retval < 0) {
|
||||
v4l2_err(&dev->v4l2_dev, "i2c adapter register failed\n");
|
||||
- goto error;
|
||||
+ goto error_free_buffers;
|
||||
}
|
||||
|
||||
client = hdpvr_register_ir_rx_i2c(dev);
|
||||
@@ -394,13 +394,17 @@ static int hdpvr_probe(struct usb_interf
|
||||
reg_fail:
|
||||
#if IS_ENABLED(CONFIG_I2C)
|
||||
i2c_del_adapter(&dev->i2c_adapter);
|
||||
+error_free_buffers:
|
||||
#endif
|
||||
+ hdpvr_free_buffers(dev);
|
||||
+error_put_usb:
|
||||
+ usb_put_dev(dev->udev);
|
||||
+ kfree(dev->usbc_buf);
|
||||
+error_v4l2_unregister:
|
||||
+ v4l2_device_unregister(&dev->v4l2_dev);
|
||||
+error_free_dev:
|
||||
+ kfree(dev);
|
||||
error:
|
||||
- if (dev) {
|
||||
- flush_work(&dev->worker);
|
||||
- /* this frees allocated memory */
|
||||
- hdpvr_delete(dev);
|
||||
- }
|
||||
return retval;
|
||||
}
|
||||
|
||||
|
|
@ -119,9 +119,6 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
|
|||
|
||||
# Security fixes
|
||||
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
||||
bugfix/all/media-dvb-usb-v2-lmedm04-Improve-logic-checking-of-w.patch
|
||||
bugfix/all/media-dvb-usb-v2-lmedm04-move-ts2020-attach-to-dm04_.patch
|
||||
bugfix/all/media-hdpvr-fix-an-error-handling-path-in-hdpvr_prob.patch
|
||||
|
||||
# Fix exported symbol versions
|
||||
bugfix/all/module-disable-matching-missing-version-crc.patch
|
||||
|
|
|
|||
Loading…
Reference in New Issue