diff options
| author | Sylwester Nawrocki <s.nawrocki@samsung.com> | 2012-09-26 04:45:21 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-10-02 13:01:30 -0400 |
| commit | 94c15b5e6755711af6dd81bde0f8396e24b75dc2 (patch) | |
| tree | 93a7da1e0a9c7ed2cca42374055e24f70b8e457b /drivers/media/i2c/s5k6aa.c | |
| parent | 7fb89eca0f2ad21f6e77f3411cb220ed94f340df (diff) | |
[media] s5k6aa: Fix possible NULL pointer dereference
Make sure __s5k6aa_get_crop_rect() always returns valid pointer,
as it is assumed at the callers.
crop->which is already validated when subdev set_crop and get_crop
callbacks are called from within the v4l2-core. If it ever happens
the crop operations are called directly for some reason in kernel
space, with incorrect crop->which argument, just log it with WARN
and return reference to the TRY crop.
Reported-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Acked-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/i2c/s5k6aa.c')
| -rw-r--r-- | drivers/media/i2c/s5k6aa.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c index 045ca7f4f6ca..57cd4fa0193d 100644 --- a/drivers/media/i2c/s5k6aa.c +++ b/drivers/media/i2c/s5k6aa.c | |||
| @@ -1061,10 +1061,9 @@ __s5k6aa_get_crop_rect(struct s5k6aa *s5k6aa, struct v4l2_subdev_fh *fh, | |||
| 1061 | { | 1061 | { |
| 1062 | if (which == V4L2_SUBDEV_FORMAT_ACTIVE) | 1062 | if (which == V4L2_SUBDEV_FORMAT_ACTIVE) |
| 1063 | return &s5k6aa->ccd_rect; | 1063 | return &s5k6aa->ccd_rect; |
| 1064 | if (which == V4L2_SUBDEV_FORMAT_TRY) | ||
| 1065 | return v4l2_subdev_get_try_crop(fh, 0); | ||
| 1066 | 1064 | ||
| 1067 | return NULL; | 1065 | WARN_ON(which != V4L2_SUBDEV_FORMAT_TRY); |
| 1066 | return v4l2_subdev_get_try_crop(fh, 0); | ||
| 1068 | } | 1067 | } |
| 1069 | 1068 | ||
| 1070 | static void s5k6aa_try_format(struct s5k6aa *s5k6aa, | 1069 | static void s5k6aa_try_format(struct s5k6aa *s5k6aa, |
| @@ -1169,12 +1168,10 @@ static int s5k6aa_get_crop(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh, | |||
| 1169 | struct v4l2_rect *rect; | 1168 | struct v4l2_rect *rect; |
| 1170 | 1169 | ||
| 1171 | memset(crop->reserved, 0, sizeof(crop->reserved)); | 1170 | memset(crop->reserved, 0, sizeof(crop->reserved)); |
| 1172 | mutex_lock(&s5k6aa->lock); | ||
| 1173 | 1171 | ||
| 1172 | mutex_lock(&s5k6aa->lock); | ||
| 1174 | rect = __s5k6aa_get_crop_rect(s5k6aa, fh, crop->which); | 1173 | rect = __s5k6aa_get_crop_rect(s5k6aa, fh, crop->which); |
| 1175 | if (rect) | 1174 | crop->rect = *rect; |
| 1176 | crop->rect = *rect; | ||
| 1177 | |||
| 1178 | mutex_unlock(&s5k6aa->lock); | 1175 | mutex_unlock(&s5k6aa->lock); |
| 1179 | 1176 | ||
| 1180 | v4l2_dbg(1, debug, sd, "Current crop rectangle: (%d,%d)/%dx%d\n", | 1177 | v4l2_dbg(1, debug, sd, "Current crop rectangle: (%d,%d)/%dx%d\n", |