Latest commit b25db38 Jul 20, 2017 @prabhakarlad prabhakarlad committed with Mauro Carvalho Chehab media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS
drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons:

- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t
  numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is
  described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user
  the user input over the kernel settings, and then compare them
  for inequality.
- We then go on to use an address provided by user space as both the
  __user pointer for input and pass it through phys_to_virt to come up
  with a kernel pointer to copy the data to. This looks like a trivially
  exploitable root hole.

Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Permalink
..
Failed to load latest commit information.
blackfin [media] media: Drop FSF's postal address from the source code files Jan 27, 2017
davinci media: platform: davinci: drop VPFE_CMD_S_CCDC_RAW_PARAMS Jul 26, 2017
drv-intf [media] media: Drop FSF's postal address from the source code files Jan 27, 2017
i2c [media] media: Drop FSF's postal address from the source code files Jan 27, 2017
cec-notifier.h media: cec-notifier: small improvements Jul 26, 2017
cec.h Merge tag 'v4.12-rc6' into patchwork Jun 20, 2017
i2c-addr.h V4L/DVB (9940): bt832: remove this driver Dec 30, 2008
imx.h [media] media: Add i.MX media core driver Jun 20, 2017
lirc.h [media] bz#75751: Move internal header file lirc.h to uapi/ Nov 17, 2015
lirc_dev.h [media] lirc_dev: cleanup header Jun 6, 2017
media-device.h [media] media: Protect enable_source and disable_source handler code … Feb 3, 2017
media-devnode.h [media] media: Drop FSF's postal address from the source code files Jan 27, 2017
media-entity.h [media] media: entity: Add media_entity_get_fwnode_pad() function Jun 20, 2017
rc-core.h [media] rc-core: cleanup rc_register_device pt2 Jun 13, 2017
rc-map.h [media] mce_kbd: add encoder Mar 24, 2017
rcar-fcp.h v4l: rcar-fcp: Add an API to retrieve the FCP device Jun 9, 2017
soc_camera.h [media] v4l: soc-camera: Remove videobuf1 support Mar 22, 2017
tuner-types.h [media] doc-rst: Fix conversion for v4l2 core functions Jul 17, 2016
tuner.h [media] v4l2-mc.h: move tuner PAD definitions to this new header Feb 1, 2016
tveeprom.h [media] tveeprom: get rid of documentation of an unused parameter Apr 5, 2017
v4l2-async.h [media] v4l: Switch from V4L2 OF not V4L2 fwnode API Jun 6, 2017
v4l2-clk.h [media] v4l2-clk: add new definition: V4L2_CLK_NAME_SIZE Nov 17, 2015
v4l2-common.h [media] v4l2-common: add a debug macro to be used with dev_foo() Nov 18, 2016
v4l2-ctrls.h [media] v4l2-ctrls.c: Implement unlocked variant of v4l2_ctrl_handler… Jun 7, 2017
v4l2-dev.h [media] get rid of a number of problems at the cross references Sep 22, 2016
v4l2-device.h [media] v4l2-device.h: fix some doc tags Sep 9, 2016
v4l2-dv-timings.h [media] v4l2-dv-timings: add helpers for vic and pixelaspect ratio Nov 16, 2016
v4l2-event.h [media] media: Drop FSF's postal address from the source code files Jan 27, 2017
v4l2-fh.h [media] media: Drop FSF's postal address from the source code files Jan 27, 2017
v4l2-flash-led-class.h [media] v4l: flash led class: Use fwnode_handle instead of device_nod… Jun 6, 2017
v4l2-fwnode.h [media] v4l: fwnode: Support generic fwnode for parsing standardised … Jun 6, 2017
v4l2-image-sizes.h [media] media: v4l2-image-sizes.h: correct the SVGA height definition Dec 4, 2014
v4l2-ioctl.h [media] v4l: Add metadata buffer type and format Apr 15, 2017
v4l2-mc.h [media] get rid of a number of problems at the cross references Sep 22, 2016
v4l2-mediabus.h [media] v4l2-mediabus: Add to DocBook Aug 22, 2015
v4l2-mem2mem.h [media] media: v4l2-mem2mem: extend m2m APIs for more accurate buffer… Jun 20, 2017
v4l2-rect.h [media] v4l2-rect.h: new header with struct v4l2_rect helper functions Apr 20, 2016
v4l2-subdev.h [media] v4l: subdev: tolerate null in media_entity_to_v4l2_subdev Jun 8, 2017
v4l2-tpg-colors.h [media] tpg: Export the tpg code from vivid as a module Apr 20, 2016
v4l2-tpg.h [media] vivid: Add support for HSV encoding Oct 21, 2016
videobuf-core.h treewide: fix typos in comment blocks Aug 7, 2015
videobuf-dma-contig.h [media] videobuf-dma-contig: remove support for cached mem Apr 25, 2013
videobuf-dma-sg.h [media] videobuf: make unused exported functions static Jan 27, 2015
videobuf-dvb.h [media] media: remove emacs editor variables Dec 22, 2014
videobuf-vmalloc.h V4L/DVB: videobuf: add ext_lock argument to the queue init functions Oct 21, 2010
videobuf2-core.h [media] vb2: Fix queue_setup() callback description Apr 5, 2017
videobuf2-dma-contig.h dma-mapping: use unsigned long for dma_attrs Aug 4, 2016
videobuf2-dma-sg.h [media] vb2: replace void *alloc_ctxs by struct device *alloc_devs Jul 8, 2016
videobuf2-dvb.h [media] add media controller support to videobuf2-dvb Feb 10, 2016
videobuf2-memops.h [media] vb2: convert vb2_vmarea_handler refcount from atomic_t to ref… Apr 5, 2017
videobuf2-v4l2.h [media] videobuf2-v4l2: document two helper functions Sep 9, 2016
videobuf2-vmalloc.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 Oct 1, 2015
vsp1.h v4l: vsp1: Add API to map and unmap DRM buffers through the VSP Jun 9, 2017