From 94c15b5e6755711af6dd81bde0f8396e24b75dc2 Mon Sep 17 00:00:00 2001 From: Sylwester Nawrocki Date: Wed, 26 Sep 2012 05:45:21 -0300 Subject: [PATCH] [media] s5k6aa: Fix possible NULL pointer dereference Make sure __s5k6aa_get_crop_rect() always returns valid pointer, as it is assumed at the callers. crop->which is already validated when subdev set_crop and get_crop callbacks are called from within the v4l2-core. If it ever happens the crop operations are called directly for some reason in kernel space, with incorrect crop->which argument, just log it with WARN and return reference to the TRY crop. Reported-by: Sachin Kamat Signed-off-by: Sylwester Nawrocki Acked-by: Sachin Kamat Signed-off-by: Mauro Carvalho Chehab --- drivers/media/i2c/s5k6aa.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c index 045ca7f4f6ca..57cd4fa0193d 100644 --- a/drivers/media/i2c/s5k6aa.c +++ b/drivers/media/i2c/s5k6aa.c @@ -1061,10 +1061,9 @@ __s5k6aa_get_crop_rect(struct s5k6aa *s5k6aa, struct v4l2_subdev_fh *fh, { if (which == V4L2_SUBDEV_FORMAT_ACTIVE) return &s5k6aa->ccd_rect; - if (which == V4L2_SUBDEV_FORMAT_TRY) - return v4l2_subdev_get_try_crop(fh, 0); - return NULL; + WARN_ON(which != V4L2_SUBDEV_FORMAT_TRY); + return v4l2_subdev_get_try_crop(fh, 0); } static void s5k6aa_try_format(struct s5k6aa *s5k6aa, @@ -1169,12 +1168,10 @@ static int s5k6aa_get_crop(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh, struct v4l2_rect *rect; memset(crop->reserved, 0, sizeof(crop->reserved)); + mutex_lock(&s5k6aa->lock); - rect = __s5k6aa_get_crop_rect(s5k6aa, fh, crop->which); - if (rect) - crop->rect = *rect; - + crop->rect = *rect; mutex_unlock(&s5k6aa->lock); v4l2_dbg(1, debug, sd, "Current crop rectangle: (%d,%d)/%dx%d\n",