Pavel Skripkin 2e004fe914 media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init ... [ Upstream commit 471bec6845 ] Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Reported-and-tested-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com Fixes: d855497edb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-06-14 16:53:49 +02:00
..
cec	media: cec: copy sequence field for the reply	2021-12-08 08:46:47 +01:00
common	media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()	2022-01-27 09:00:55 +01:00
dvb-core	media: dmxdev: fix UAF when dvb_register_device() fails	2022-01-27 09:00:49 +01:00
dvb-frontends	media: dib8000: Fix a memleak in dib8000_init()	2022-01-27 09:00:50 +01:00
firewire	media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()	2021-11-12 14:28:22 +01:00
i2c	media: mt9p031: Fix corrupted frame after restarting stream	2021-11-26 11:40:27 +01:00
mmc	…
pci	media: cx25821: Fix the warning when removing the module	2022-06-14 16:53:44 +02:00
platform	media: exynos4-is: Change clk_disable to clk_disable_unprepare	2022-06-14 16:53:49 +02:00
radio	media: si470x: Avoid card name truncation	2021-11-26 11:40:29 +01:00
rc	media: igorplugusb: receiver overflow should be reported	2022-01-27 09:00:55 +01:00
spi	…
tuners	media: msi001: fix possible null-ptr-deref in msi001_probe()	2022-01-27 09:00:50 +01:00
usb	media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init	2022-06-14 16:53:49 +02:00
v4l2-core	media: v4l2-dv-timings.c: fix wrong condition in two for-loops	2021-09-22 11:45:29 +02:00
Kconfig	…
Makefile	…
media-device.c	media: mc-device.c: don't memset __user pointer contents	2019-07-31 07:28:22 +02:00
media-devnode.c	…
media-entity.c	…