On Fri May 1 23:28:31 2026 +0300, Sergey Shtylyov wrote:
> If CONFIG_MEDIA_CONTROLLER is undefined, media_request_object_find() will
> always return NULL, so its 2nd call in v4l2_ctrl_request_complete() would
> fail as well as the 1st one and thus cause hdl to have a wrong value (at
> the top of memory) and list_for_each_entry() to iterate over the garbage
> data located there. Add NULL check for the 2nd call and place the error
> cleanup at the end of v4l2_ctrl_request_complete()...
>
> Found by Linux Verification Center (linuxtesting.org) with the Svace static
> analysis tool.
>
> Fixes: c3bf5129f339 ("media: v4l2-ctrls: always copy the controls on
> completion")
> Cc: [email protected]
> Signed-off-by: Sergey Shtylyov <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/v4l2-core/v4l2-ctrls-request.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
---
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-request.c
b/drivers/media/v4l2-core/v4l2-ctrls-request.c
index 4b7e6981b8d6..5c2fc767c6a6 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls-request.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-request.c
@@ -348,13 +348,12 @@ void v4l2_ctrl_request_complete(struct media_request *req,
ret = v4l2_ctrl_handler_init(hdl, (main_hdl->nr_of_buckets - 1)
* 8);
if (!ret)
ret = v4l2_ctrl_request_bind(req, hdl, main_hdl);
- if (ret) {
- v4l2_ctrl_handler_free(hdl);
- kfree(hdl);
- return;
- }
+ if (ret)
+ goto error;
hdl->request_is_queued = true;
obj = media_request_object_find(req, &req_ops, main_hdl);
+ if (!obj)
+ goto error;
}
hdl = container_of(obj, struct v4l2_ctrl_handler, req_obj);
@@ -389,6 +388,11 @@ void v4l2_ctrl_request_complete(struct media_request *req,
mutex_unlock(main_hdl->lock);
media_request_object_complete(obj);
media_request_object_put(obj);
+ return;
+
+error:
+ v4l2_ctrl_handler_free(hdl);
+ kfree(hdl);
}
EXPORT_SYMBOL(v4l2_ctrl_request_complete);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
