linux/drivers/media/usb/pvrusb2
Pavel Skripkin 471bec6845 media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
Syzbot reported that -1 is used as array index. The problem was in
missing validation check.

hdw->unit_number is initialized with -1 and then if init table walk fails
this value remains unchanged. Since code blindly uses this member for
array indexing adding sanity check is the easiest fix for that.

hdw->workpoll initialization moved upper to prevent warning in
__flush_work.

Reported-and-tested-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com

Fixes: d855497edb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-05-13 11:02:19 +02:00
..
Kconfig media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
Makefile
pvrusb2-audio.c
pvrusb2-audio.h
pvrusb2-context.c
pvrusb2-context.h
pvrusb2-cs53l32a.c
pvrusb2-cs53l32a.h
pvrusb2-ctrl.c media: pvrusb2: Replaced simple_strtol() with kstrtoint() 2021-09-30 10:07:53 +02:00
pvrusb2-ctrl.h
pvrusb2-cx2584x-v4l.c
pvrusb2-cx2584x-v4l.h
pvrusb2-debug.h
pvrusb2-debugifc.c
pvrusb2-debugifc.h
pvrusb2-devattr.c
pvrusb2-devattr.h
pvrusb2-dvb.c
pvrusb2-dvb.h
pvrusb2-eeprom.c
pvrusb2-eeprom.h
pvrusb2-encoder.c media: pvrusb2: fix inconsistent indenting 2021-11-30 12:24:31 +01:00
pvrusb2-encoder.h
pvrusb2-fx2-cmd.h
pvrusb2-hdw-internal.h
pvrusb2-hdw.c media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init 2022-05-13 11:02:19 +02:00
pvrusb2-hdw.h
pvrusb2-i2c-core.c
pvrusb2-i2c-core.h
pvrusb2-io.c
pvrusb2-io.h
pvrusb2-ioread.c
pvrusb2-ioread.h
pvrusb2-main.c
pvrusb2-std.c
pvrusb2-std.h
pvrusb2-sysfs.c
pvrusb2-sysfs.h
pvrusb2-util.h
pvrusb2-v4l2.c media: pvrusb2: Do not check for V4L2_CTRL_WHICH_DEF_VAL 2021-09-30 10:07:46 +02:00
pvrusb2-v4l2.h
pvrusb2-video-v4l.c
pvrusb2-video-v4l.h
pvrusb2-wm8775.c
pvrusb2-wm8775.h
pvrusb2.h