When using v4l2_subdev_set_routing to set a subdev's routing, and the
passed routing.num_routes is 0, kmemdup is not called to populate the
routes of the new routing (which is fine, since we wouldn't want to pass
a possible NULL value to kmemdup).
This results in subdev's routing.routes to be NULL.
routing.routes is further used in some places without being guarded by
the same num_routes non-zero condition.
Fix it.
Signed-off-by: Cosmin Tanislav <demonsingur@xxxxxxxxx>
---
drivers/media/v4l2-core/v4l2-subdev.c | 46 +++++++++++++--------------
1 file changed, 23 insertions(+), 23 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
index cde1774c9098d..4f0eecd7fd66f 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -605,6 +605,23 @@ subdev_ioctl_get_state(struct v4l2_subdev *sd, struct v4l2_subdev_fh *subdev_fh,
v4l2_subdev_get_unlocked_active_state(sd);
}
+static void subdev_copy_krouting(struct v4l2_subdev_routing *routing,
+ struct v4l2_subdev_krouting *krouting)
+{
+ memset(routing->reserved, 0, sizeof(routing->reserved));
+
+ if (!krouting->routes) {
+ routing->num_routes = 0;
+ return;
+ }
+
+ memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
+ krouting->routes,
+ min(krouting->num_routes, routing->len_routes) *
+ sizeof(*krouting->routes));
+ routing->num_routes = krouting->num_routes;
+}
+
static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
struct v4l2_subdev_state *state)
{
@@ -976,7 +993,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
case VIDIOC_SUBDEV_G_ROUTING: {
struct v4l2_subdev_routing *routing = arg;
- struct v4l2_subdev_krouting *krouting;
if (!v4l2_subdev_enable_streams_api)
return -ENOIOCTLCMD;
@@ -984,15 +1000,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS))
return -ENOIOCTLCMD;
- memset(routing->reserved, 0, sizeof(routing->reserved));
-
- krouting = &state->routing;
-
- memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
- krouting->routes,
- min(krouting->num_routes, routing->len_routes) *
- sizeof(*krouting->routes));
- routing->num_routes = krouting->num_routes;
+ subdev_copy_krouting(routing, &state->routing);
return 0;
}
@@ -1016,8 +1024,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
if (routing->num_routes > routing->len_routes)
return -EINVAL;
- memset(routing->reserved, 0, sizeof(routing->reserved));
-
for (i = 0; i < routing->num_routes; ++i) {
const struct v4l2_subdev_route *route = &routes[i];
const struct media_pad *pads = sd->entity.pads;
@@ -1046,12 +1052,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
* the routing table.
*/
if (!v4l2_subdev_has_op(sd, pad, set_routing)) {
- memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
- state->routing.routes,
- min(state->routing.num_routes, routing->len_routes) *
- sizeof(*state->routing.routes));
- routing->num_routes = state->routing.num_routes;
-
+ subdev_copy_krouting(routing, &state->routing);
return 0;
}
@@ -1064,11 +1065,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
if (rval < 0)
return rval;
- memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
- state->routing.routes,
- min(state->routing.num_routes, routing->len_routes) *
- sizeof(*state->routing.routes));
- routing->num_routes = state->routing.num_routes;
+ subdev_copy_krouting(routing, &state->routing);
return 0;
}
@@ -1956,6 +1953,9 @@ struct v4l2_subdev_route *
__v4l2_subdev_next_active_route(const struct v4l2_subdev_krouting *routing,
struct v4l2_subdev_route *route)
{
+ if (!routing->routes)
+ return NULL;
+
if (route)
++route;
else
--
2.47.0
