| Message ID | 20221207141808.22922-1-a.burakov@rosalinux.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: v4l2-flash: fix NULL dereference in v4l2_flash_s_ctrl() | expand |
Hi Alexandr, On Wed, Dec 07, 2022 at 05:18:07PM +0300, Aleksandr Burakov wrote: > The NULL check added for fled_cdev before dereference. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru> > Fixes: 42bd6f59ae90 ("media: Add registration helpers for V4L2 flash sub-devices") > --- > drivers/media/v4l2-core/v4l2-flash-led-class.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/media/v4l2-core/v4l2-flash-led-class.c b/drivers/media/v4l2-core/v4l2-flash-led-class.c > index 355595a0fefa..36cc46e80eea 100644 > --- a/drivers/media/v4l2-core/v4l2-flash-led-class.c > +++ b/drivers/media/v4l2-core/v4l2-flash-led-class.c > @@ -291,12 +291,16 @@ static int v4l2_flash_s_ctrl(struct v4l2_ctrl *c) > * No conversion is needed as LED Flash class also uses > * microseconds for flash timeout units. > */ > + if (!fled_cdev) > + return -EINVAL; > return led_set_flash_timeout(fled_cdev, c->val); > case V4L2_CID_FLASH_INTENSITY: > /* > * No conversion is needed as LED Flash class also uses > * microamperes for flash intensity units. > */ > + if (!fled_cdev) > + return -EINVAL; > return led_set_flash_brightness(fled_cdev, c->val); > } > fled_cdev won't be NULL above, this is checked elsewhere in the V4L2 flash LED class code. I guess the question then is whether doing such a check is meaningful. It would require a bug elsewhere in the code to happen.
diff --git a/drivers/media/v4l2-core/v4l2-flash-led-class.c b/drivers/media/v4l2-core/v4l2-flash-led-class.c index 355595a0fefa..36cc46e80eea 100644 --- a/drivers/media/v4l2-core/v4l2-flash-led-class.c +++ b/drivers/media/v4l2-core/v4l2-flash-led-class.c @@ -291,12 +291,16 @@ static int v4l2_flash_s_ctrl(struct v4l2_ctrl *c) * No conversion is needed as LED Flash class also uses * microseconds for flash timeout units. */ + if (!fled_cdev) + return -EINVAL; return led_set_flash_timeout(fled_cdev, c->val); case V4L2_CID_FLASH_INTENSITY: /* * No conversion is needed as LED Flash class also uses * microamperes for flash intensity units. */ + if (!fled_cdev) + return -EINVAL; return led_set_flash_brightness(fled_cdev, c->val); }
The NULL check added for fled_cdev before dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Aleksandr Burakov <a.burakov@rosalinux.ru> Fixes: 42bd6f59ae90 ("media: Add registration helpers for V4L2 flash sub-devices") --- drivers/media/v4l2-core/v4l2-flash-led-class.c | 4 ++++ 1 file changed, 4 insertions(+)