Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 94c15b5e authored by Sylwester Nawrocki's avatar Sylwester Nawrocki Committed by Mauro Carvalho Chehab
Browse files

[media] s5k6aa: Fix possible NULL pointer dereference 



Make sure __s5k6aa_get_crop_rect() always returns valid pointer,
as it is assumed at the callers.
crop->which is already validated when subdev set_crop and get_crop
callbacks are called from within the v4l2-core. If it ever happens
the crop operations are called directly for some reason in kernel
space, with incorrect crop->which argument, just log it with WARN
and return reference to the TRY crop.

Reported-by: default avatarSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: default avatarSylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: default avatarSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 7fb89eca

drivers/media/i2c/s5k6aa.c

+4 −7
Original line number Diff line number Diff line
@@ -1061,10 +1061,9 @@ __s5k6aa_get_crop_rect(struct s5k6aa *s5k6aa, struct v4l2_subdev_fh *fh, 
{

	if (which == V4L2_SUBDEV_FORMAT_ACTIVE)

		return &s5k6aa->ccd_rect;

	if (which == V4L2_SUBDEV_FORMAT_TRY)

		return v4l2_subdev_get_try_crop(fh, 0);



	return NULL;

	WARN_ON(which != V4L2_SUBDEV_FORMAT_TRY);

	return v4l2_subdev_get_try_crop(fh, 0);

}



static void s5k6aa_try_format(struct s5k6aa *s5k6aa,
@@ -1169,12 +1168,10 @@ static int s5k6aa_get_crop(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh, 
	struct v4l2_rect *rect;



	memset(crop->reserved, 0, sizeof(crop->reserved));

	mutex_lock(&s5k6aa->lock);



	mutex_lock(&s5k6aa->lock);

	rect = __s5k6aa_get_crop_rect(s5k6aa, fh, crop->which);

	if (rect)

	crop->rect = *rect;



	mutex_unlock(&s5k6aa->lock);



	v4l2_dbg(1, debug, sd, "Current crop rectangle: (%d,%d)/%dx%d\n",