Arnd Bergmann 1dc8b65c94 media: v4l2-core: only zero-out ioctl-read buffers ... The memset() got moved out of the check for _IOC_NONE, so passing a made-up command number with a size but no direction would allow clearing data on user-provided pointers. Move video_get_user() back into the _IOC_NONE check where it belongs. Reported-by: syzbot+54fd8cca4b7226c94b8e@syzkaller.appspotmail.com Fixes: 6c625c01c7a6 ("media: v4l2-core: split out data copy from video_usercopy") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>		2020-01-08 13:27:58 +01:00
..
cec	media: cec: check 'transmit_in_progress', not 'transmitting'	2019-12-13 11:22:10 +01:00
common	media: v4l2: abstract timeval handling in v4l2_buffer	2020-01-03 15:43:35 +01:00
dvb-core	media: dvb-core: Fix receiving invalid EIT-sections	2020-01-08 11:46:34 +01:00
dvb-frontends	media: au8522: improve formatting	2020-01-08 11:45:50 +01:00
firewire	media: firewire: Make structure fdtv_ca constant	2019-08-21 18:39:55 -03:00
i2c	media: i2c: mt9v032: fix enum mbus codes and frame sizes	2020-01-04 08:09:59 +01:00
mc	media: mc-device.c: fix memleak in media_device_register_entity	2019-10-01 12:26:35 -03:00
mmc
pci	media: v4l2: abstract timeval handling in v4l2_buffer	2020-01-03 15:43:35 +01:00
platform	Linux 5.5-rc5	2020-01-08 11:13:25 +01:00
radio	media: si470x-i2c: add missed operations in remove	2019-11-10 07:28:15 +01:00
rc	media: rc: ir-hix5hd2: add hi3796cv300-ir support	2020-01-08 11:48:20 +01:00
spi
tuners	media: tuners: Use the correct style for SPDX License Identifier	2019-10-24 18:57:55 -03:00
usb	media: dvb: add support for TerraTec TC2 Stick (193534)	2020-01-03 16:30:24 +01:00
v4l2-core	media: v4l2-core: only zero-out ioctl-read buffers	2020-01-08 13:27:58 +01:00
Kconfig
Makefile