github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

Browse Source 
The current implementation of alvium_ctrl_init creates several controls in
function alvium_ctrl_init and uses the returned pointer without check. That
can cause write access over NULL-pointer for several controls. The reworked
code checks the pointers before adding flags.

Fixes: 0a7af87291 ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Hecht <mhecht73@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
This commit is contained in:
Martin Hecht 2026-05-08 11:59:03 +02:00 committed by Sakari Ailus
parent 11f94f5b1d
commit 4f6f28ff24
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/media/i2c/alvium-csi2.c
View File

@ -2100,20 +2100,21 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
V4L2_CID_PIXEL_RATE, 0,
ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1,
ALVIUM_DEFAULT_PIXEL_RATE_MHZ);
ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
/* Link freq is fixed */
ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops,
V4L2_CID_LINK_FREQ,
0, 0, &alvium->link_freq);
ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
if (ctrls->link_freq)
ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
/* Auto/manual white balance */
if (alvium->avail_ft.auto_whiteb) {
ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops,
V4L2_CID_AUTO_WHITE_BALANCE,
0, 1, 1, 1);
v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
if (ctrls->auto_wb)
v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
}
ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
@ -2122,6 +2123,7 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
alvium->max_bbalance,
alvium->inc_bbalance,
alvium->dft_bbalance);
ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
V4L2_CID_RED_BALANCE,
alvium->min_rbalance,
@ -2136,7 +2138,9 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
V4L2_CID_EXPOSURE_AUTO,
V4L2_EXPOSURE_MANUAL, 0,
V4L2_EXPOSURE_AUTO);
v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
if (ctrls->auto_exp)
v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp,
V4L2_EXPOSURE_MANUAL, true);
}
ctrls->exposure = v4l2_ctrl_new_std(hdl, ops,
@ -2145,14 +2149,16 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
alvium->max_exp,
alvium->inc_exp,
alvium->dft_exp);
ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
if (ctrls->exposure)
ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
/* Auto/manual gain */
if (alvium->avail_ft.auto_gain) {
ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
V4L2_CID_AUTOGAIN,
0, 1, 1, 1);
v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
if (ctrls->auto_gain)
v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
}
if (alvium->avail_ft.gain) {
@ -2162,7 +2168,8 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
alvium->max_gain,
alvium->inc_gain,
alvium->dft_gain);
ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
if (ctrls->gain)
ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
}
if (alvium->avail_ft.sat)