Rajeshwar R Shinde c6b6b86922 media: gspca: cpia1: shift-out-of-bounds in set_flicker ...

[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]

Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'

When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.

Reported-by: syzbot+e27f3dbdab04e43b9f73@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73
Signed-off-by: Rajeshwar R Shinde <coolrrsh@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-11-28 16:54:52 +00:00

..

airspy

media: media/usb: don't set description in ENUM_FMT

2019-07-22 14:01:05 -04:00

as102

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118

2019-05-24 17:39:02 +02:00

au0828

media: au0828: fix a NULL vs IS_ERR() check

2021-07-14 16:56:05 +02:00

b2c2

media: flexcop-usb: fix endpoint type check

2022-09-28 11:10:26 +02:00

cpia2

media: cpia2: fix control-message timeouts

2022-01-27 10:53:42 +01:00

cx231xx

Merge tag 'v5.9-rc4' into patchwork

2020-09-07 16:13:06 +02:00

dvb-usb

media: af9005: Fix null-ptr-deref in af9005_i2c_xfer

2023-09-23 11:01:07 +02:00

dvb-usb-v2

media: dvb-usb-v2: af9035: fix missing unlock

2023-11-20 11:06:55 +01:00

em28xx

media: Revert "media: em28xx: add missing em28xx_close_extension"

2022-04-08 14:40:36 +02:00

go7007

media: go7007: Remove redundant if statement

2023-09-19 12:20:18 +02:00

gspca

media: gspca: cpia1: shift-out-of-bounds in set_flicker

2023-11-28 16:54:52 +00:00

hackrf

Merge tag 'v5.2-rc4' into media/master

2019-06-11 12:09:28 -04:00

hdpvr

media: hdpvr: fix error value returns in hdpvr_read

2022-08-21 15:15:41 +02:00

msi2500

media: msi2500: assign SPI bus number dynamically

2020-12-26 16:02:45 +01:00

pvrusb2

media: pvrusb2: fix memory leak in pvr_probe

2022-09-05 10:28:56 +02:00

pwc

media: pwc: Use correct device for DMA

2021-02-23 15:53:25 +01:00

s2255

media: s2255: fix control-message timeouts

2022-01-27 10:53:42 +01:00

siano

drivers: usb: smsusb: fix error handling code in smsusb_init_device

2023-09-19 12:20:16 +02:00

stk1160

media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED

2022-04-08 14:40:09 +02:00

stkwebcam

media: stkwebcam: fix memory leak in stk_camera_probe

2021-09-08 08:49:02 +02:00

tm6000

media: tm6000: Avoid card name truncation

2021-11-18 14:04:05 +01:00

ttusb-budget

media: dvb-ttusb-budget: cleanup printk logic

2020-09-03 11:15:47 +02:00

ttusb-dec

media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()

2023-06-09 10:30:10 +02:00

usbtv

media: usbtv: Fix deadlock on suspend

2021-03-17 17:06:20 +01:00

uvc

media: uvcvideo: Fix race condition with usb_kill_urb

2023-03-11 16:40:20 +01:00

zr364xx

media: drivers/media/usb: fix memory leak in zr364xx_probe

2021-08-26 08:35:34 -04:00

Kconfig

media: move CEC USB drivers to a separate directory

2020-04-15 12:06:40 +02:00

Makefile

media: move CEC USB drivers to a separate directory

2020-04-15 12:06:40 +02:00