mirror of
https://github.com/torvalds/linux.git
synced 2024-12-05 10:32:35 +00:00
471bec6845
Syzbot reported that -1 is used as array index. The problem was in
missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails
this value remains unchanged. Since code blindly uses this member for
array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in
__flush_work.
Reported-and-tested-by: syzbot+1a247e36149ffd709a9b@syzkaller.appspotmail.com
Fixes:
|
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
pvrusb2-audio.c | ||
pvrusb2-audio.h | ||
pvrusb2-context.c | ||
pvrusb2-context.h | ||
pvrusb2-cs53l32a.c | ||
pvrusb2-cs53l32a.h | ||
pvrusb2-ctrl.c | ||
pvrusb2-ctrl.h | ||
pvrusb2-cx2584x-v4l.c | ||
pvrusb2-cx2584x-v4l.h | ||
pvrusb2-debug.h | ||
pvrusb2-debugifc.c | ||
pvrusb2-debugifc.h | ||
pvrusb2-devattr.c | ||
pvrusb2-devattr.h | ||
pvrusb2-dvb.c | ||
pvrusb2-dvb.h | ||
pvrusb2-eeprom.c | ||
pvrusb2-eeprom.h | ||
pvrusb2-encoder.c | ||
pvrusb2-encoder.h | ||
pvrusb2-fx2-cmd.h | ||
pvrusb2-hdw-internal.h | ||
pvrusb2-hdw.c | ||
pvrusb2-hdw.h | ||
pvrusb2-i2c-core.c | ||
pvrusb2-i2c-core.h | ||
pvrusb2-io.c | ||
pvrusb2-io.h | ||
pvrusb2-ioread.c | ||
pvrusb2-ioread.h | ||
pvrusb2-main.c | ||
pvrusb2-std.c | ||
pvrusb2-std.h | ||
pvrusb2-sysfs.c | ||
pvrusb2-sysfs.h | ||
pvrusb2-util.h | ||
pvrusb2-v4l2.c | ||
pvrusb2-v4l2.h | ||
pvrusb2-video-v4l.c | ||
pvrusb2-video-v4l.h | ||
pvrusb2-wm8775.c | ||
pvrusb2-wm8775.h | ||
pvrusb2.h |