Commit 4c76f331 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() 



As detected by Coverity, the error check logic at get_ctrl() is
broken: if ptr_to_user() fails to fill a control due to an error,
no errors are returned and v4l2_g_ctrl() returns success on a
failed operation, which may cause applications to fail.

Add an error check at get_ctrl() and ensure that it will
be returned to userspace without filling the control value if
get_ctrl() fails.

Fixes: 71c689dc ("media: v4l2-ctrls: split up into four source files")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent fa88dc7d

drivers/media/v4l2-core/v4l2-ctrls-api.c

+11 −6
Original line number Diff line number Diff line
@@ -753,9 +753,10 @@ static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c) 
		for (i = 0; i < master->ncontrols; i++)

			cur_to_new(master->cluster[i]);

		ret = call_op(master, g_volatile_ctrl);

		new_to_user(c, ctrl);

		if (!ret)

			ret = new_to_user(c, ctrl);

	} else {

		cur_to_user(c, ctrl);

		ret = cur_to_user(c, ctrl);

	}

	v4l2_ctrl_unlock(master);

	return ret;
@@ -770,7 +771,10 @@ int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_control *control) 
	if (!ctrl || !ctrl->is_int)

		return -EINVAL;

	ret = get_ctrl(ctrl, &c);



	if (!ret)

		control->value = c.value;



	return ret;

}

EXPORT_SYMBOL(v4l2_g_ctrl);
@@ -811,10 +815,11 @@ static int set_ctrl_lock(struct v4l2_fh *fh, struct v4l2_ctrl *ctrl, 
	int ret;



	v4l2_ctrl_lock(ctrl);

	user_to_new(c, ctrl);

	ret = user_to_new(c, ctrl);

	if (!ret)

		ret = set_ctrl(fh, ctrl, 0);

	if (!ret)

		cur_to_user(c, ctrl);

		ret = cur_to_user(c, ctrl);

	v4l2_ctrl_unlock(ctrl);

	return ret;

}