lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0245/1039] media: uvcvideo: Avoid invalid memory access
    Date
    From: Ricardo Ribalda <ribalda@chromium.org>

    [ Upstream commit f0577b1b6394f954903fcc67e12fe9e7001dafd6 ]

    If mappings points to an invalid memory, we will be invalid accessing
    it. Solve it by initializing the value of the variable mapping and by
    changing the order in the conditional statement (to avoid accessing
    mapping->id if not needed).

    Fix:
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI

    Fixes: 6350d6a4ed487 ("media: uvcvideo: Set error_idx during ctrl_commit errors")
    Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/uvc/uvc_ctrl.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
    index 30bfe9069a1fb..9a25d60292558 100644
    --- a/drivers/media/usb/uvc/uvc_ctrl.c
    +++ b/drivers/media/usb/uvc/uvc_ctrl.c
    @@ -1638,7 +1638,7 @@ static int uvc_ctrl_find_ctrl_idx(struct uvc_entity *entity,
    struct v4l2_ext_controls *ctrls,
    struct uvc_control *uvc_control)
    {
    - struct uvc_control_mapping *mapping;
    + struct uvc_control_mapping *mapping = NULL;
    struct uvc_control *ctrl_found;
    unsigned int i;

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-25 01:11    [W:3.365 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site