b25db38392
drop VPFE_CMD_S_CCDC_RAW_PARAMS ioctl from dm355/dm644x following reasons: - This ioctl was never in public api and was only defined in kernel header. - The function set_params constantly mixes up pointers and phys_addr_t numbers. - This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is described as an 'experimental ioctl that will change in future kernels'. - The code to allocate the table never gets called after we copy_from_user the user input over the kernel settings, and then compare them for inequality. - We then go on to use an address provided by user space as both the __user pointer for input and pass it through phys_to_virt to come up with a kernel pointer to copy the data to. This looks like a trivially exploitable root hole. Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
||
---|---|---|
.. | ||
blackfin | ||
davinci | ||
drv-intf | ||
i2c | ||
cec-notifier.h | ||
cec.h | ||
i2c-addr.h | ||
imx.h | ||
lirc_dev.h | ||
lirc.h | ||
media-device.h | ||
media-devnode.h | ||
media-entity.h | ||
rc-core.h | ||
rc-map.h | ||
rcar-fcp.h | ||
soc_camera.h | ||
tuner-types.h | ||
tuner.h | ||
tveeprom.h | ||
v4l2-async.h | ||
v4l2-clk.h | ||
v4l2-common.h | ||
v4l2-ctrls.h | ||
v4l2-dev.h | ||
v4l2-device.h | ||
v4l2-dv-timings.h | ||
v4l2-event.h | ||
v4l2-fh.h | ||
v4l2-flash-led-class.h | ||
v4l2-fwnode.h | ||
v4l2-image-sizes.h | ||
v4l2-ioctl.h | ||
v4l2-mc.h | ||
v4l2-mediabus.h | ||
v4l2-mem2mem.h | ||
v4l2-rect.h | ||
v4l2-subdev.h | ||
v4l2-tpg-colors.h | ||
v4l2-tpg.h | ||
videobuf-core.h | ||
videobuf-dma-contig.h | ||
videobuf-dma-sg.h | ||
videobuf-dvb.h | ||
videobuf-vmalloc.h | ||
videobuf2-core.h | ||
videobuf2-dma-contig.h | ||
videobuf2-dma-sg.h | ||
videobuf2-dvb.h | ||
videobuf2-memops.h | ||
videobuf2-v4l2.h | ||
videobuf2-vmalloc.h | ||
vsp1.h |