Re: [PATCH] drivers: staging: greybus: fix GPF issue in gb_camera_capture

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 5/4/23 PM10:54, Johan Hovold wrote:
On Thu, May 04, 2023 at 09:58:41PM +0800, Dongliang Mu wrote:
In gb_camera_capture(), it does not check the value of settings
before dereferencing it. And gb_camera_debugfs_capture calls
gb_camera_capture with the 6th parameter settings as NULL.
Looks like you just broke gb_camera_debugfs_capture() which relies on
passing NULL as settings.

Yes, just mentioned by Dan, this memcpy is intended with zero length and NULL src.

Please ignore this patch.

Fix this by checking the value of setting at the starting of
gb_camera_capture.

Fixes: 3265edaf0d70 ("greybus: Add driver for the camera class protocol")
Signed-off-by: Dongliang Mu <dzm91@xxxxxxxxxxx>
---
  drivers/staging/greybus/camera.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/camera.c b/drivers/staging/greybus/camera.c
index cdbb42cd413b..5a4b26e7f645 100644
--- a/drivers/staging/greybus/camera.c
+++ b/drivers/staging/greybus/camera.c
@@ -659,7 +659,7 @@ static int gb_camera_capture(struct gb_camera *gcam, u32 request_id,
  	size_t req_size;
  	int ret;
- if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE)
+	if (settings_size > GB_CAMERA_MAX_SETTINGS_SIZE || !settings)
  		return -EINVAL;
req_size = sizeof(*req) + settings_size;
Johan




[Index of Archives]     [Linux Driver Development]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux