summaryrefslogtreecommitdiffstats
path: root/drivers/media/i2c
diff options
context:
space:
mode:
authorSylwester Nawrocki <s.nawrocki@samsung.com>2012-09-26 05:45:21 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2012-10-02 14:01:30 -0300
commit94c15b5e6755711af6dd81bde0f8396e24b75dc2 (patch)
tree93a7da1e0a9c7ed2cca42374055e24f70b8e457b /drivers/media/i2c
parent7fb89eca0f2ad21f6e77f3411cb220ed94f340df (diff)
downloadlinux-94c15b5e6755711af6dd81bde0f8396e24b75dc2.tar.bz2
[media] s5k6aa: Fix possible NULL pointer dereference
Make sure __s5k6aa_get_crop_rect() always returns valid pointer, as it is assumed at the callers. crop->which is already validated when subdev set_crop and get_crop callbacks are called from within the v4l2-core. If it ever happens the crop operations are called directly for some reason in kernel space, with incorrect crop->which argument, just log it with WARN and return reference to the TRY crop. Reported-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Acked-by: Sachin Kamat <sachin.kamat@linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/i2c')
-rw-r--r--drivers/media/i2c/s5k6aa.c11
1 files changed, 4 insertions, 7 deletions
diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c
index 045ca7f4f6ca..57cd4fa0193d 100644
--- a/drivers/media/i2c/s5k6aa.c
+++ b/drivers/media/i2c/s5k6aa.c
@@ -1061,10 +1061,9 @@ __s5k6aa_get_crop_rect(struct s5k6aa *s5k6aa, struct v4l2_subdev_fh *fh,
{
if (which == V4L2_SUBDEV_FORMAT_ACTIVE)
return &s5k6aa->ccd_rect;
- if (which == V4L2_SUBDEV_FORMAT_TRY)
- return v4l2_subdev_get_try_crop(fh, 0);
- return NULL;
+ WARN_ON(which != V4L2_SUBDEV_FORMAT_TRY);
+ return v4l2_subdev_get_try_crop(fh, 0);
}
static void s5k6aa_try_format(struct s5k6aa *s5k6aa,
@@ -1169,12 +1168,10 @@ static int s5k6aa_get_crop(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh,
struct v4l2_rect *rect;
memset(crop->reserved, 0, sizeof(crop->reserved));
- mutex_lock(&s5k6aa->lock);
+ mutex_lock(&s5k6aa->lock);
rect = __s5k6aa_get_crop_rect(s5k6aa, fh, crop->which);
- if (rect)
- crop->rect = *rect;
-
+ crop->rect = *rect;
mutex_unlock(&s5k6aa->lock);
v4l2_dbg(1, debug, sd, "Current crop rectangle: (%d,%d)/%dx%d\n",