Vikash Garodia f4743a0cb3 media: venus: hfi: fix the check to handle session buffer requirement ... commit b18e36dfd6 upstream. Buffer requirement, for different buffer type, comes from video firmware. While copying these requirements, there is an OOB possibility when the payload from firmware is more than expected size. Fix the check to avoid the OOB possibility. Cc: stable@vger.kernel.org Fixes: 09c2845e8f ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Reviewed-by: Nathan Hebert <nhebert@chromium.org> Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com> Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-11-28 16:45:45 +00:00
..
cec	media: cec: copy sequence field for the reply	2021-12-08 08:46:47 +01:00
common	media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()	2022-01-27 09:00:55 +01:00
dvb-core	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221	2023-06-09 10:22:51 +02:00
dvb-frontends	media: dvb: symbol fixup for dvb_attach() - again	2023-10-10 21:43:40 +02:00
firewire	media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()	2021-11-12 14:28:22 +01:00
i2c	media: m5mols: fix off-by-one loop termination error	2023-03-22 13:26:15 +01:00
mmc
pci	media: pci: cx23885: replace BUG with error return	2023-09-23 10:47:05 +02:00
platform	media: venus: hfi: fix the check to handle session buffer requirement	2023-11-28 16:45:45 +00:00
radio	media: radio-shark: Add endpoint checks	2023-05-30 12:38:38 +01:00
rc	media: sharp: fix sharp encoding	2023-11-28 16:45:45 +00:00
spi
tuners	media: dvb: symbol fixup for dvb_attach() - again	2023-10-10 21:43:40 +02:00
usb	media: gspca: cpia1: shift-out-of-bounds in set_flicker	2023-11-28 16:45:44 +00:00
v4l2-core	media: v4l2-dv-timings.c: fix too strict blanking sanity checks	2022-12-14 11:26:13 +01:00
Kconfig
Makefile
media-device.c	media: mc-device.c: don't memset __user pointer contents	2019-07-31 07:28:22 +02:00
media-devnode.c
media-entity.c