| From de1e473ab4ac0f16f0f684c6e581f5f2ca44f06a Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 7 Aug 2020 10:35:30 +0200 |
| Subject: media: uvcvideo: Fix dereference of out-of-bound list iterator |
| |
| From: Daniel W. S. Almeida <dwlsalmeida@gmail.com> |
| |
| [ Upstream commit f875bcc375c738bf2f599ff2e1c5b918dbd07c45 ] |
| |
| Fixes the following coccinelle report: |
| |
| drivers/media/usb/uvc/uvc_ctrl.c:1860:5-11: |
| ERROR: invalid reference to the index variable of the iterator on line 1854 |
| |
| by adding a boolean variable to check if the loop has found the |
| |
| Found using - Coccinelle (http://coccinelle.lip6.fr) |
| |
| [Replace cursor variable with bool found] |
| |
| Signed-off-by: Daniel W. S. Almeida <dwlsalmeida@gmail.com> |
| Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/usb/uvc/uvc_ctrl.c | 13 +++++++++---- |
| 1 file changed, 9 insertions(+), 4 deletions(-) |
| |
| diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c |
| index a30a8a731eda8..c13ed95cb06fe 100644 |
| --- a/drivers/media/usb/uvc/uvc_ctrl.c |
| +++ b/drivers/media/usb/uvc/uvc_ctrl.c |
| @@ -1848,30 +1848,35 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain, |
| { |
| struct uvc_entity *entity; |
| struct uvc_control *ctrl; |
| - unsigned int i, found = 0; |
| + unsigned int i; |
| + bool found; |
| u32 reqflags; |
| u16 size; |
| u8 *data = NULL; |
| int ret; |
| |
| /* Find the extension unit. */ |
| + found = false; |
| list_for_each_entry(entity, &chain->entities, chain) { |
| if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT && |
| - entity->id == xqry->unit) |
| + entity->id == xqry->unit) { |
| + found = true; |
| break; |
| + } |
| } |
| |
| - if (entity->id != xqry->unit) { |
| + if (!found) { |
| uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n", |
| xqry->unit); |
| return -ENOENT; |
| } |
| |
| /* Find the control and perform delayed initialization if needed. */ |
| + found = false; |
| for (i = 0; i < entity->ncontrols; ++i) { |
| ctrl = &entity->controls[i]; |
| if (ctrl->index == xqry->selector - 1) { |
| - found = 1; |
| + found = true; |
| break; |
| } |
| } |
| -- |
| 2.27.0 |
| |