Hans Verkuil 71f9c0f1e3 media: v4l2-core: v4l2-dv-timings: check cvt/gtf result ... commit 9f070b1862 upstream. The v4l2_detect_cvt/gtf functions should check the result against the timing capabilities: these functions calculate the timings, so if they are out of bounds, they should be rejected. To do this, add the struct v4l2_dv_timings_cap as argument to those functions. This required updates to the adv7604 and adv7842 drivers since the prototype of these functions has now changed. The timings struct that is passed to v4l2_detect_cvt/gtf in those two drivers is filled with the timings detected by the hardware. The vivid driver was also updated, but an additional check was added: the width and height specified by VIDIOC_S_DV_TIMINGS has to match the calculated result, otherwise something went wrong. Note that vivid *emulates* hardware, so all the values passed to the v4l2_detect_cvt/gtf functions came from the timings struct that was filled by userspace and passed on to the driver via VIDIOC_S_DV_TIMINGS. So these fields can contain random data. Both the constraints check via struct v4l2_dv_timings_cap and the additional width/height check ensure that the resulting timings are sane and not messed up by the v4l2_detect_cvt/gtf calculations. Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Fixes: 2576415846 ("[media] v4l2: move dv-timings related code to v4l2-dv-timings.c") Cc: stable@vger.kernel.org Reported-by: syzbot+a828133770f62293563e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-media/000000000000013050062127830a@google.com/ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-12-14 19:54:04 +01:00
..
davinci
drv-intf
i2c
tpg
cec-notifier.h
cec-pin.h
cec.h	media: cec: core: avoid recursive cec_claim_log_addrs	2024-06-12 11:03:48 +02:00
demux.h
dmxdev.h
dvb_ca_en50221.h
dvb_demux.h
dvb_frontend.h
dvb_math.h
dvb_net.h
dvb_ringbuffer.h
dvb_vb2.h
dvb-usb-ids.h
dvbdev.h
frame_vector.h
imx.h
media-dev-allocator.h
media-device.h
media-devnode.h
media-entity.h	media: mc: Add num_links flag to media_pad	2024-04-03 15:19:25 +02:00
media-request.h
mipi-csi2.h
rc-core.h
rc-map.h
rcar-fcp.h
tuner-types.h
tuner.h
tveeprom.h
v4l2-async.h
v4l2-common.h
v4l2-ctrls.h
v4l2-dev.h
v4l2-device.h
v4l2-dv-timings.h	media: v4l2-core: v4l2-dv-timings: check cvt/gtf result	2024-12-14 19:54:04 +01:00
v4l2-event.h
v4l2-fh.h
v4l2-flash-led-class.h
v4l2-fwnode.h
v4l2-h264.h
v4l2-image-sizes.h
v4l2-ioctl.h
v4l2-jpeg.h
v4l2-mc.h
v4l2-mediabus.h
v4l2-mem2mem.h	media: v4l2-mem2mem: add lock to protect parameter num_rdy	2023-08-23 17:52:23 +02:00
v4l2-rect.h
v4l2-subdev.h
v4l2-uvc.h
v4l2-vp9.h
videobuf-core.h
videobuf-dma-contig.h
videobuf-dma-sg.h
videobuf-vmalloc.h
videobuf2-core.h
videobuf2-dma-contig.h
videobuf2-dma-sg.h
videobuf2-dvb.h
videobuf2-memops.h
videobuf2-v4l2.h
videobuf2-vmalloc.h
vsp1.h