]> git.ipfire.org Git - thirdparty/linux.git/commit
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()
authorSergey Shtylyov <s.shtylyov@auroraos.dev>
Fri, 1 May 2026 20:28:31 +0000 (23:28 +0300)
committerHans Verkuil <hverkuil+cisco@kernel.org>
Wed, 6 May 2026 07:17:37 +0000 (09:17 +0200)
commitcaced3578bf9f104a4aaad8f46c4c719e705d9a6
tree512e01d1bf64809c56e1b5645e23a3c9268ba0f2
parente4107c6b301d1afa4e3ae471f964da83d15ead4a
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()

If CONFIG_MEDIA_CONTROLLER is undefined, media_request_object_find() will
always return NULL, so its 2nd call in v4l2_ctrl_request_complete() would
fail as well as the 1st one and thus cause hdl to have a wrong value (at
the top of memory) and list_for_each_entry() to iterate over the garbage
data located there. Add NULL check for the 2nd call and place the error
cleanup at the end of v4l2_ctrl_request_complete()...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: c3bf5129f339 ("media: v4l2-ctrls: always copy the controls on completion")
Cc: stable@vger.kernel.org
Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
drivers/media/v4l2-core/v4l2-ctrls-request.c