diff --git a/drivers/media/v4l2-core/v4l2-isp.c b/drivers/media/v4l2-core/v4l2-isp.c index 1eb46e080afa..8e6c2ef326aa 100644 --- a/drivers/media/v4l2-core/v4l2-isp.c +++ b/drivers/media/v4l2-core/v4l2-isp.c @@ -99,12 +99,25 @@ int v4l2_isp_params_validate_buffer(struct device *dev, struct vb2_buffer *vb, return -EINVAL; } + /* + * An empty type info entry denotes a block type the driver + * does not support. Reject the buffer instead of ignoring the + * block: accepting it silently would let userspace fill it + * with data that a later kernel, once it implements the type, + * would validate and possibly reject. + */ + info = &type_info[block->type]; + if (!info->size) { + dev_dbg(dev, "Unsupported block type %u at offset %zu\n", + block->type, block_offset); + return -EINVAL; + } + /* * Match the block reported size against the type info provided * one, but allow the block to only contain the header in * case it is going to be disabled. */ - info = &type_info[block->type]; if (block->size != info->size && (!(block->flags & V4L2_ISP_PARAMS_FL_BLOCK_DISABLE) || block->size != sizeof(*block))) {