Patch "media: uvcvideo: Fix dereference of out-of-bound list iterator" has been added to the 5.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    media: uvcvideo: Fix dereference of out-of-bound list iterator

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-uvcvideo-fix-dereference-of-out-of-bound-list-.patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit de1e473ab4ac0f16f0f684c6e581f5f2ca44f06a
Author: Daniel W. S. Almeida <dwlsalmeida@xxxxxxxxx>
Date:   Fri Aug 7 10:35:30 2020 +0200

    media: uvcvideo: Fix dereference of out-of-bound list iterator
    
    [ Upstream commit f875bcc375c738bf2f599ff2e1c5b918dbd07c45 ]
    
    Fixes the following coccinelle report:
    
    drivers/media/usb/uvc/uvc_ctrl.c:1860:5-11:
    ERROR: invalid reference to the index variable of the iterator on line 1854
    
    by adding a boolean variable to check if the loop has found the
    
    Found using - Coccinelle (http://coccinelle.lip6.fr)
    
    [Replace cursor variable with bool found]
    
    Signed-off-by: Daniel W. S. Almeida <dwlsalmeida@xxxxxxxxx>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index a30a8a731eda8..c13ed95cb06fe 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1848,30 +1848,35 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
 {
 	struct uvc_entity *entity;
 	struct uvc_control *ctrl;
-	unsigned int i, found = 0;
+	unsigned int i;
+	bool found;
 	u32 reqflags;
 	u16 size;
 	u8 *data = NULL;
 	int ret;
 
 	/* Find the extension unit. */
+	found = false;
 	list_for_each_entry(entity, &chain->entities, chain) {
 		if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&
-		    entity->id == xqry->unit)
+		    entity->id == xqry->unit) {
+			found = true;
 			break;
+		}
 	}
 
-	if (entity->id != xqry->unit) {
+	if (!found) {
 		uvc_trace(UVC_TRACE_CONTROL, "Extension unit %u not found.\n",
 			xqry->unit);
 		return -ENOENT;
 	}
 
 	/* Find the control and perform delayed initialization if needed. */
+	found = false;
 	for (i = 0; i < entity->ncontrols; ++i) {
 		ctrl = &entity->controls[i];
 		if (ctrl->index == xqry->selector - 1) {
-			found = 1;
+			found = true;
 			break;
 		}
 	}