Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f2e90847 authored by Laurent Pinchart's avatar Laurent Pinchart Committed by Mauro Carvalho Chehab
Browse files

[media] v4l: Validate fields in the core code for subdev EDID ioctls 



The subdev EDID ioctls receive a pad field that must reference an
existing pad and an EDID field that must point to a buffer. Validate
both fields in the core code instead of duplicating validation in all
drivers.

Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent 9cfd65e8

drivers/media/i2c/ad9389b.c

+0 −2
Original line number Diff line number Diff line
@@ -682,8 +682,6 @@ static int ad9389b_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) 
		return -EINVAL;

	if (edid->blocks == 0 || edid->blocks > 256)

		return -EINVAL;

	if (!edid->edid)

		return -EINVAL;

	if (!state->edid.segments) {

		v4l2_dbg(1, debug, sd, "EDID segment 0 not found\n");

		return -ENODATA;

drivers/media/i2c/adv7511.c

+0 −2
Original line number Diff line number Diff line
@@ -783,8 +783,6 @@ static int adv7511_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) 
		return -EINVAL;

	if ((edid->blocks == 0) || (edid->blocks > 256))

		return -EINVAL;

	if (!edid->edid)

		return -EINVAL;

	if (!state->edid.segments) {

		v4l2_dbg(1, debug, sd, "EDID segment 0 not found\n");

		return -ENODATA;

drivers/media/i2c/adv7604.c

+0 −4
Original line number Diff line number Diff line
@@ -1673,8 +1673,6 @@ static int adv7604_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) 
		return -EINVAL;

	if (edid->start_block == 1)

		edid->blocks = 1;

	if (!edid->edid)

		return -EINVAL;



	if (edid->blocks > state->edid.blocks)

		edid->blocks = state->edid.blocks;
@@ -1761,8 +1759,6 @@ static int adv7604_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) 
		edid->blocks = 2;

		return -E2BIG;

	}

	if (!edid->edid)

		return -EINVAL;



	v4l2_dbg(2, debug, sd, "%s: write EDID pad %d, edid.present = 0x%x\n",

			__func__, edid->pad, state->edid.present);

drivers/media/i2c/adv7842.c

+0 −4
Original line number Diff line number Diff line
@@ -2036,8 +2036,6 @@ static int adv7842_get_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid) 
		return -EINVAL;

	if (edid->start_block == 1)

		edid->blocks = 1;

	if (!edid->edid)

		return -EINVAL;



	switch (edid->pad) {

	case ADV7842_EDID_PORT_A:
@@ -2072,8 +2070,6 @@ static int adv7842_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *e) 
		return -EINVAL;

	if (e->blocks > 2)

		return -E2BIG;

	if (!e->edid)

		return -EINVAL;



	/* todo, per edid */

	state->aspect_ratio = v4l2_calc_aspect_ratio(e->edid[0x15],

drivers/media/v4l2-core/v4l2-subdev.c

+20 −4
Original line number Diff line number Diff line
@@ -361,11 +361,27 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg) 
			sd, pad, set_selection, subdev_fh, sel);

	}



	case VIDIOC_G_EDID:

		return v4l2_subdev_call(sd, pad, get_edid, arg);

	case VIDIOC_G_EDID: {

		struct v4l2_subdev_edid *edid = arg;



	case VIDIOC_S_EDID:

		return v4l2_subdev_call(sd, pad, set_edid, arg);

		if (edid->pad >= sd->entity.num_pads)

			return -EINVAL;

		if (edid->blocks && edid->edid == NULL)

			return -EINVAL;



		return v4l2_subdev_call(sd, pad, get_edid, edid);

	}



	case VIDIOC_S_EDID: {

		struct v4l2_subdev_edid *edid = arg;



		if (edid->pad >= sd->entity.num_pads)

			return -EINVAL;

		if (edid->blocks && edid->edid == NULL)

			return -EINVAL;



		return v4l2_subdev_call(sd, pad, set_edid, edid);

	}



	case VIDIOC_SUBDEV_DV_TIMINGS_CAP: {

		struct v4l2_dv_timings_cap *cap = arg;