lkml.org 
[lkml]   [2020]   [Oct]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 27/60] media: uvcvideo: Fix dereference of out-of-bound list iterator
    Date
    From: "Daniel W. S. Almeida" <dwlsalmeida@gmail.com>

    [ Upstream commit f875bcc375c738bf2f599ff2e1c5b918dbd07c45 ]

    Fixes the following coccinelle report:

    drivers/media/usb/uvc/uvc_ctrl.c:1860:5-11:
    ERROR: invalid reference to the index variable of the iterator on line 1854

    by adding a boolean variable to check if the loop has found the

    Found using - Coccinelle (http://coccinelle.lip6.fr)

    [Replace cursor variable with bool found]

    Signed-off-by: Daniel W. S. Almeida <dwlsalmeida@gmail.com>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/uvc/uvc_ctrl.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
    index f2854337cdcac..262b7ba4674a7 100644
    --- a/drivers/media/usb/uvc/uvc_ctrl.c
    +++ b/drivers/media/usb/uvc/uvc_ctrl.c
    @@ -1849,30 +1849,35 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
    {
    struct uvc_entity *entity;
    struct uvc_control *ctrl;
    - unsigned int i, found = 0;
    + unsigned int i;
    + bool found;
    u32 reqflags;
    u16 size;
    u8 *data = NULL;
    int ret;

    /* Find the extension unit. */
    + found = false;
    list_for_each_entry(entity, &chain->entities, chain) {
    if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&
    - entity->id == xqry->unit)
    + entity->id == xqry->unit) {
    + found = true;
    break;
    + }
    }

    - if (entity->id != xqry->unit) {
    + if (!found) {
    uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n",
    xqry->unit);
    return -ENOENT;
    }

    /* Find the control and perform delayed initialization if needed. */
    + found = false;
    for (i = 0; i < entity->ncontrols; ++i) {
    ctrl = &entity->controls[i];
    if (ctrl->index == xqry->selector - 1) {
    - found = 1;
    + found = true;
    break;
    }
    }
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-10-27 01:08    [W:4.192 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site