linux-kernel - [PATCH] media: v4l2-fwnode: Check subdev count after checking port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20171115115522.30211-1-tfiga@chromium.org>
Date:   Wed, 15 Nov 2017 20:55:22 +0900
From:   Tomasz Figa <tfiga@...omium.org>
To:     linux-media@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Sakari Ailus <sakari.ailus@...ux.intel.com>,
        Hans Verkuil <hans.verkuil@...co.com>,
        Sebastian Reichel <sre@...nel.org>,
        Niklas Söderlund 
        <niklas.soderlund+renesas@...natech.se>,
        Tomasz Figa <tfiga@...omium.org>
Subject: [PATCH] media: v4l2-fwnode: Check subdev count after checking port

Current implementation of __v4l2_async_notifier_parse_fwnode_endpoints()
checks first whether subdev_count >= subdev_max and only then whether
the port being parsed matches the given port index. This triggers an
error in otherwise valid cases of skipping ports that do not match.

Fix this by moving the check below the port index check.

Fixes: 9ca465312132 ("media: v4l: fwnode: Support generic parsing of graph endpoints in a device")
Signed-off-by: Tomasz Figa <tfiga@...omium.org>
---
 drivers/media/v4l2-core/v4l2-fwnode.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
index 681b192420d9..fb72c7ac04d4 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -458,11 +458,6 @@ static int __v4l2_async_notifier_parse_fwnode_endpoints(
 		if (!is_available)
 			continue;
 
-		if (WARN_ON(notifier->num_subdevs >= notifier->max_subdevs)) {
-			ret = -EINVAL;
-			break;
-		}
-
 		if (has_port) {
 			struct fwnode_endpoint ep;
 
@@ -474,6 +469,11 @@ static int __v4l2_async_notifier_parse_fwnode_endpoints(
 				continue;
 		}
 
+		if (WARN_ON(notifier->num_subdevs >= notifier->max_subdevs)) {
+			ret = -EINVAL;
+			break;
+		}
+
 		ret = v4l2_async_notifier_fwnode_parse_endpoint(
 			dev, notifier, fwnode, asd_struct_size, parse_endpoint);
 		if (ret < 0)
-- 
2.15.0.448.gf294e3d99a-goog