linux/drivers/media/usb
Arnd Bergmann 005145378c [media] dvb-usb-v2: avoid use-after-free
I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:

drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.

This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
2017-02-08 11:45:09 -02:00
..
airspy [media] usb: constify vb2_ops structures 2016-09-19 16:20:35 -03:00
as102 media: usb: as102: as102_usb_drv: don't print error when allocating urb fails 2016-08-30 19:13:53 +02:00
au0828 [media] media: Protect enable_source and disable_source handler code paths 2017-02-03 07:39:35 -02:00
b2c2 [media] b2c2: don't break long lines 2016-10-21 09:38:31 -02:00
cpia2 [media] media: usb: cpia2: Use kmemdup instead of kmalloc and memcpy 2017-01-31 07:46:34 -02:00
cx231xx [media] cx231xx: Fix I2C on Internal Master 3 Bus 2017-02-07 09:09:10 -02:00
dvb-usb [media] add Hama Hybrid DVB-T Stick support 2017-02-08 10:54:58 -02:00
dvb-usb-v2 [media] dvb-usb-v2: avoid use-after-free 2017-02-08 11:45:09 -02:00
em28xx [media] em28xx: support for Hauppauge WinTV-dualHD 01595 ATSC/QAM 2017-02-03 13:46:42 -02:00
go7007 [media] go7007: add MEDIA_CAMERA_SUPPORT dependency 2016-11-23 13:15:02 -02:00
gspca [media] gspca_stv06xx: remove redundant check for err < 0 2017-02-03 11:18:33 -02:00
hackrf [media] usb: constify vb2_ops structures 2016-09-19 16:20:35 -03:00
hdpvr [media] hdpvr: fix interrupted recording 2016-11-16 13:30:30 -02:00
msi2500 [media] usb: constify vb2_ops structures 2016-09-19 16:20:35 -03:00
pulse8-cec [media] cec: pass parent device in register(), not allocate() 2016-11-29 12:07:17 -02:00
pvrusb2 [media] pvrusb2-io: Add some spaces for better code readability 2017-01-31 08:05:45 -02:00
pwc Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
s2255 [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
siano [media] siano: don't break long lines 2016-10-21 09:52:50 -02:00
stk1160 [media] stk1160: make some functions static 2017-02-03 11:30:37 -02:00
stkwebcam [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
tm6000 [media] tm6000: fix typo in parameter description 2017-02-03 14:23:29 -02:00
ttusb-budget [media] ttusb-budget: don't break long lines 2016-10-21 09:54:20 -02:00
ttusb-dec [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
usbtv media updates for v4.10-rc1 2016-12-16 09:39:16 -08:00
usbvision [media] media/usbvision: remove ctrl_urb_wq 2017-02-03 13:40:20 -02:00
uvc [media] uvcvideo: Change result code of debugfs_init to void 2017-01-31 10:56:48 -02:00
zr364xx [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
Kconfig [media] pulse8-cec: move out of staging 2016-11-16 15:47:12 -02:00
Makefile [media] pulse8-cec: move out of staging 2016-11-16 15:47:12 -02:00