From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Jozef Vesely <vesely@gjh.sk>,
Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
Mauro Carvalho Chehab <mchehab@redhat.com>
Subject: [ 75/91] media: uvcvideo: Fix ENUMINPUT handling
Date: Sun, 27 May 2012 09:26:21 +0900 [thread overview]
Message-ID: <20120527002523.193739526@linuxfoundation.org> (raw)
In-Reply-To: <20120527010903.GA18244@kroah.com>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
commit 31c5f0c5e25ed71eeced170f113bb590f2f1f6f3 upstream.
Properly validate the user-supplied index against the number of inputs.
The code used the pin local variable instead of the index by mistake.
Reported-by: Jozef Vesely <vesely@gjh.sk>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/video/uvc/uvc_v4l2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -687,7 +687,7 @@ static long uvc_v4l2_do_ioctl(struct fil
break;
}
pin = iterm->id;
- } else if (pin < selector->bNrInPins) {
+ } else if (index < selector->bNrInPins) {
pin = selector->baSourceID[index];
list_for_each_entry(iterm, &chain->entities, chain) {
if (!UVC_ENTITY_IS_ITERM(iterm))
next prev parent reply other threads:[~2012-05-27 0:26 UTC|newest]
Thread overview: 116+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-05-27 1:09 [ 00/91] 3.4.1-stable review Greg KH
2012-05-27 0:25 ` [ 01/91] isdn/gigaset: ratelimit CAPI message dumps Greg KH
2012-05-27 0:25 ` [ 02/91] isdn/gigaset: fix CAPI disconnect B3 handling Greg KH
2012-05-27 0:25 ` [ 03/91] isdn/gigaset: improve error handling querying firmware version Greg KH
2012-05-27 0:25 ` [ 04/91] vfs: make AIO use the proper rw_verify_area() area helpers Greg KH
2012-05-27 0:25 ` [ 05/91] iwlwifi: use 6000G2B for 6030 device series Greg KH
2012-05-27 13:34 ` Ben Hutchings
2012-06-01 7:03 ` Greg KH
2012-05-27 0:25 ` [ 06/91] iwlwifi: use correct released ucode version Greg KH
2012-05-27 0:25 ` [ 07/91] net/wireless: ipw2200: Fix WARN_ON occurring in wiphy_register called by ipw_pci_probe Greg KH
2012-05-27 19:24 ` Herton Ronaldo Krzesinski
2012-05-27 19:50 ` Ben Hutchings
2012-05-27 0:25 ` [ 08/91] cfg80211: warn if db.txt is empty with CONFIG_CFG80211_INTERNAL_REGDB Greg KH
2012-05-27 0:25 ` [ 09/91] regulator: core: Release regulator-regulator supplies on error Greg KH
2012-05-27 0:25 ` [ 10/91] Fix blocking allocations called very early during bootup Greg KH
2012-05-27 0:25 ` [ 11/91] s390/pfault: fix task state race Greg KH
2012-05-27 0:25 ` [ 12/91] SCSI: mpt2sas: Fix for panic happening because of improper memory allocation Greg KH
2012-05-27 0:25 ` [ 13/91] isci: fix oem parameter validation on single controller skus Greg KH
2012-05-27 0:25 ` [ 14/91] RDMA/cxgb4: Always wake up waiters in c4iw_peer_abort_intr() Greg KH
2012-05-27 0:25 ` [ 15/91] RDMA/cxgb4: Use dst parameter in import_ep() Greg KH
2012-05-27 0:25 ` [ 16/91] RDMA/cxgb4: Drop peer_abort when no endpoint found Greg KH
2012-05-27 0:25 ` [ 17/91] powerpc: Fix broken cpu_idle_wait() implementation Greg KH
2012-05-27 0:25 ` [ 18/91] KEYS: Use the compat keyctl() syscall wrapper on Sparc64 for Sparc32 compat Greg KH
2012-05-27 0:25 ` [ 19/91] SELinux: if sel_make_bools errors dont leave inconsistent state Greg KH
2012-05-27 0:25 ` [ 20/91] fbdev: sh_mobile_lcdc: Dont confuse line size with pitch Greg KH
2012-05-27 0:25 ` [ 21/91] IB/core: Fix mismatch between locked and pinned pages Greg KH
2012-05-27 0:25 ` [ 22/91] drivers/staging/comedi/comedi_fops.c: add missing vfree Greg KH
2012-05-27 0:25 ` [ 23/91] perf/x86: Update event scheduling constraints for AMD family 15h models Greg KH
2012-05-27 0:25 ` [ 24/91] HID: wiimote: Fix IR data parser Greg KH
2012-05-27 0:25 ` [ 25/91] usbhid: prevent deadlock during timeout Greg KH
2012-05-27 0:25 ` [ 26/91] HID: logitech: read all 32 bits of report type bitfield Greg KH
2012-05-27 0:25 ` [ 27/91] um: Fix __swp_type() Greg KH
2012-05-27 0:25 ` [ 28/91] um: Implement a custom pte_same() function Greg KH
2012-05-27 0:25 ` [ 29/91] persistent_ram: Fix buffer size clamping during writes Greg KH
2012-05-27 0:25 ` [ 30/91] docs: update HOWTO for 2.6.x -> 3.x versioning Greg KH
2012-05-27 0:25 ` [ 31/91] USB: cdc-wdm: sanitize error returns Greg KH
2012-05-27 0:25 ` [ 32/91] USB: cdc-wdm: fix memory leak Greg KH
2012-05-27 0:25 ` [ 33/91] USB: cdc-wdm: poll must return POLLHUP if device is gone Greg KH
2012-05-27 0:25 ` [ 34/91] USB: cdc-wdm: cannot use dev_printk when " Greg KH
2012-05-27 0:25 ` [ 35/91] USB: cdc-wdm: remove from device list on disconnect Greg KH
2012-05-27 0:25 ` [ 36/91] workqueue: skip nr_running sanity check in worker_enter_idle() if trustee is active Greg KH
2012-05-27 0:25 ` [ 37/91] mm: mempolicy: Let vma_merge and vma_split handle vma->vm_policy linkages Greg KH
2012-05-27 0:25 ` [ 38/91] md: using GFP_NOIO to allocate bio for flush request Greg KH
2012-05-27 0:25 ` [ 39/91] Add missing call to uart_update_timeout() Greg KH
2012-05-27 0:25 ` [ 40/91] 8250.c: less than 2400 baud fix Greg KH
2012-05-27 0:25 ` [ 41/91] 8250_pci: fix pch uart matching Greg KH
2012-05-27 0:25 ` [ 42/91] tty: Allow uart_register/unregister/register Greg KH
2012-05-27 0:25 ` [ 43/91] USB: ftdi-sio: add support for Physik Instrumente E-861 Greg KH
2012-05-27 0:25 ` [ 44/91] usb-serial: ftdi_sio: fix oops during autosuspend Greg KH
2012-05-27 0:25 ` [ 45/91] usb-storage: unusual_devs entry for Yarvik PMP400 MP4 player Greg KH
2012-05-27 0:25 ` [ 46/91] USB: ffs-test: fix length argument of out function call Greg KH
2012-05-27 0:25 ` [ 47/91] usb: usbtest: two super speed fixes for usbtest Greg KH
2012-05-27 0:25 ` [ 48/91] USB: ehci-platform: remove update_device Greg KH
2012-05-27 0:25 ` [ 49/91] USB: EHCI: OMAP: Finish ehci omap phy reset cycle before adding hcd Greg KH
2012-05-27 0:25 ` [ 50/91] USB: gpio_vbus: provide an appropriate debounce interval Greg KH
2012-05-27 0:25 ` [ 51/91] USB: ohci-at91: add a reset function to fix race condition Greg KH
2012-05-27 0:25 ` [ 52/91] USB: Remove races in devio.c Greg KH
2012-05-27 0:25 ` [ 53/91] USB: serial: ti_usb_3410_5052: Add support for the FRI2 serial console Greg KH
2012-05-27 0:26 ` [ 54/91] usb: gadget: fsl_udc_core: dTDs next dtd pointer need to be updated once written Greg KH
2012-05-27 0:26 ` [ 55/91] usb: add USB_QUIRK_RESET_RESUME for M-Audio 88es Greg KH
2012-05-27 0:26 ` [ 56/91] xhci: Add Lynx Point to list of Intel switchable hosts Greg KH
2012-05-27 0:26 ` [ 57/91] xHCI: keep track of ports being resumed and indicate in hub_status_data Greg KH
2012-05-27 0:26 ` [ 58/91] xhci: Avoid dead ports when CONFIG_USB_XHCI_HCD=n Greg KH
2012-05-27 0:26 ` [ 59/91] usb-xhci: Handle COMP_TX_ERR for isoc tds Greg KH
2012-05-27 0:26 ` [ 60/91] xhci: Reset reserved command ring TRBs on cleanup Greg KH
2012-05-27 0:26 ` [ 61/91] xhci: Add new short TX quirk for Fresco Logic host Greg KH
2012-05-27 0:26 ` [ 62/91] USB: fix resource leak in xhci power loss path Greg KH
2012-05-27 0:26 ` [ 63/91] usbcore: enable USB2 LPM if port suspend fails Greg KH
2012-05-27 0:26 ` [ 64/91] gma500: Fix Poulsbo suspend/resume crash on devices with SDVO ports Greg KH
2012-05-27 0:26 ` [ 65/91] b43legacy: Fix error due to MMIO access with SSB unpowered Greg KH
2012-05-27 0:26 ` [ 66/91] drm/i915: Avoid a double-read of PCH_IIR during interrupt handling Greg KH
2012-05-27 0:26 ` [ 67/91] drm/i915: [GEN7] Use HW scheduler for fixed function shaders Greg KH
2012-05-27 0:26 ` [ 68/91] drm/i915: dont clobber the pipe param in sanitize_modesetting Greg KH
2012-05-27 0:26 ` [ 69/91] gpio: mpc8xxx: Prevent NULL pointer deref in demux handler Greg KH
2012-05-27 0:26 ` [ 70/91] spi/spi-fsl-spi: reference correct pdata in fsl_spi_cs_control Greg KH
2012-05-27 0:26 ` [ 71/91] hvc_xen: NULL dereference on allocation failure Greg KH
2012-05-27 0:26 ` [ 72/91] xen: do not map the same GSI twice in PVHVM guests Greg KH
2012-05-27 0:26 ` [ 73/91] nouveau: nouveau_set_bo_placement takes TTM flags Greg KH
2012-05-27 0:26 ` [ 74/91] [media] smsusb: add autodetection support for USB ID 2040:c0a0 Greg KH
2012-05-27 0:26 ` Greg KH [this message]
2012-05-27 0:26 ` [ 76/91] x86, relocs: Build clean fix Greg KH
2012-05-27 0:26 ` [ 77/91] x86-32, relocs: Whitelist more symbols for ld bug workaround Greg KH
2012-05-27 0:26 ` [ 78/91] x86, relocs: Add jiffies and jiffies_64 to the relative whitelist Greg KH
2012-05-27 0:26 ` [ 79/91] x86/mce: Fix check for processor context when machine check was taken Greg KH
2012-05-27 0:26 ` [ 80/91] mmc: sdio: avoid spurious calls to interrupt handlers Greg KH
2012-05-27 0:26 ` [ 81/91] mmc: cd-gpio: protect against NULL context in mmc_cd_gpio_free() Greg KH
2012-05-27 0:26 ` [ 82/91] mmc: omap_hsmmc: pass IRQF_ONESHOT to request_threaded_irq Greg KH
2012-05-27 0:26 ` [ 83/91] tile: fix bug where fls(0) was not returning 0 Greg KH
2012-05-27 0:26 ` [ 84/91] intel-iommu: Add device info into list before doing context mapping Greg KH
2012-05-27 0:26 ` [ 85/91] iommu: Fix off by one in dmar_get_fault_reason() Greg KH
2012-05-27 0:26 ` [ 86/91] ARM: 7365/1: drop unused parameter from flush_cache_user_range Greg KH
2012-05-27 0:26 ` [ 87/91] ARM: 7409/1: Do not call flush_cache_user_range with mmap_sem held Greg KH
2012-05-27 0:26 ` [ 88/91] ARM: dt: tegra cardhu: fix typo in SDHCI node name Greg KH
2012-05-27 0:26 ` [ 89/91] MCE: Fix vm86 handling for 32bit mce handler Greg KH
2012-05-27 0:26 ` [ 90/91] i2c: davinci: Free requested IRQ in remove Greg KH
2012-05-27 0:26 ` [ 91/91] i2c: tegra: notify transfer-complete after clearing status Greg KH
2012-05-27 17:02 ` [ 00/91] 3.4.1-stable review Willy Tarreau
2012-05-27 20:00 ` Greg KH
2012-05-28 14:18 ` [ 00/91] 3.4.1-stable review Fw: [PATCH 1/2] libata: add a host flag to ignore detected ATA devices FW: use hv_storvsc instead of ata_piix to handle the IDE disks devices ( but not for the CD-ROM) Victor Miasnikov
2012-05-28 20:35 ` Greg KH
2012-05-28 20:40 ` Jonathan Nieder
2012-05-29 6:34 ` Linux on Hyper-V 1) cd006086fa5d ata_piix: defer disks to the Hyper-V drivers by default 2) db63a4c8115a libata: add a host flag to ignore detected ATA device " Victor Miasnikov
2012-06-01 9:20 ` Greg KH
2012-06-01 16:17 ` Linux on Hyper-V 1) cd006086fa5d ata_piix: defer disks to the Hyper-V drivers by default 2) db63a4c8115a libata: add a host flag to ignore detected ATA device FW: use hv_storvsc instead of ata_piix to handle the IDE disks devices ( but not for the CD-R Victor Miasnikov
2012-06-01 16:26 ` Greg KH
2012-06-01 19:23 ` Linux on Hyper-V 1) cd006086fa5d ata_piix: defer disks to the Hyper-V drivers by default 2) db63a4c8115a libata: add a host flag to ignore detected ATA device FW: use hv_storvsc instead of ata_piix to handle the IDE disks devices ( but not for the KY Srinivasan
2012-06-02 1:22 ` Greg KH
2012-06-04 12:33 ` Victor Miasnikov
2012-06-04 13:56 ` KY Srinivasan
2012-06-04 14:15 ` Victor Miasnikov
2012-06-04 14:19 ` KY Srinivasan
2012-06-04 15:57 ` Victor Miasnikov
2012-06-05 4:59 ` [PATCH 2/2] ata_piix: defer disks to the Hyper-V drivers by default Jonathan Nieder
2012-06-05 6:50 ` ToDo: backport to v3.4 , v3.3 , v3.2 patches 1b) db63a4c8115a libata 1) cd006086fa5d ata_piix: defer disks to the Hyper-V drivers by default Fw: use hv_storvsc instead of ata_piix for IDE disks ( but not for the CD-ROM) Victor Miasnikov
2012-05-29 9:38 ` [ 00/91] 3.4.1-stable review Greg KH
2012-05-29 16:57 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120527002523.193739526@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@redhat.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=vesely@gjh.sk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).