On Fri, Nov 22, 2024 at 04:37:12PM +0200, Cosmin Tanislav wrote:
> When using v4l2_subdev_set_routing to set a subdev's routing, and the
> passed routing.num_routes is 0, kmemdup is not called to populate the
> routes of the new routing (which is fine, since we wouldn't want to pass
> a possible NULL value to kmemdup).
>
> This results in subdev's routing.routes to be NULL.
>
> routing.routes is further used in some places without being guarded by
> the same num_routes non-zero condition.
What other places is that ? Have you experienced a crash anywhere ?
>
> Fix it.
>
A Fixes: tag would be good to help backporting.
> Signed-off-by: Cosmin Tanislav <demonsingur@xxxxxxxxx>
> ---
> drivers/media/v4l2-core/v4l2-subdev.c | 46 +++++++++++++--------------
> 1 file changed, 23 insertions(+), 23 deletions(-)
>
> diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
> index cde1774c9098d..4f0eecd7fd66f 100644
> --- a/drivers/media/v4l2-core/v4l2-subdev.c
> +++ b/drivers/media/v4l2-core/v4l2-subdev.c
> @@ -605,6 +605,23 @@ subdev_ioctl_get_state(struct v4l2_subdev *sd, struct v4l2_subdev_fh *subdev_fh,
> v4l2_subdev_get_unlocked_active_state(sd);
> }
>
> +static void subdev_copy_krouting(struct v4l2_subdev_routing *routing,
> + struct v4l2_subdev_krouting *krouting)
The second argument should be const.
> +{
> + memset(routing->reserved, 0, sizeof(routing->reserved));
> +
> + if (!krouting->routes) {
> + routing->num_routes = 0;
> + return;
> + }
> +
> + memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> + krouting->routes,
> + min(krouting->num_routes, routing->len_routes) *
> + sizeof(*krouting->routes));
> + routing->num_routes = krouting->num_routes;
> +}
> +
> static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> struct v4l2_subdev_state *state)
> {
> @@ -976,7 +993,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
>
> case VIDIOC_SUBDEV_G_ROUTING: {
> struct v4l2_subdev_routing *routing = arg;
> - struct v4l2_subdev_krouting *krouting;
>
> if (!v4l2_subdev_enable_streams_api)
> return -ENOIOCTLCMD;
> @@ -984,15 +1000,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS))
> return -ENOIOCTLCMD;
>
> - memset(routing->reserved, 0, sizeof(routing->reserved));
> -
> - krouting = &state->routing;
> -
> - memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> - krouting->routes,
> - min(krouting->num_routes, routing->len_routes) *
> - sizeof(*krouting->routes));
> - routing->num_routes = krouting->num_routes;
> + subdev_copy_krouting(routing, &state->routing);
>
> return 0;
> }
> @@ -1016,8 +1024,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> if (routing->num_routes > routing->len_routes)
> return -EINVAL;
>
> - memset(routing->reserved, 0, sizeof(routing->reserved));
> -
> for (i = 0; i < routing->num_routes; ++i) {
> const struct v4l2_subdev_route *route = &routes[i];
> const struct media_pad *pads = sd->entity.pads;
> @@ -1046,12 +1052,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> * the routing table.
> */
> if (!v4l2_subdev_has_op(sd, pad, set_routing)) {
> - memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> - state->routing.routes,
> - min(state->routing.num_routes, routing->len_routes) *
> - sizeof(*state->routing.routes));
> - routing->num_routes = state->routing.num_routes;
> -
> + subdev_copy_krouting(routing, &state->routing);
> return 0;
> }
>
> @@ -1064,11 +1065,7 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
> if (rval < 0)
> return rval;
>
> - memcpy((struct v4l2_subdev_route *)(uintptr_t)routing->routes,
> - state->routing.routes,
> - min(state->routing.num_routes, routing->len_routes) *
> - sizeof(*state->routing.routes));
> - routing->num_routes = state->routing.num_routes;
> + subdev_copy_krouting(routing, &state->routing);
>
> return 0;
> }
> @@ -1956,6 +1953,9 @@ struct v4l2_subdev_route *
> __v4l2_subdev_next_active_route(const struct v4l2_subdev_krouting *routing,
> struct v4l2_subdev_route *route)
> {
> + if (!routing->routes)
> + return NULL;
> +
> if (route)
> ++route;
> else
--
Regards,
Laurent Pinchart
