media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

The current implementation of alvium_ctrl_init creates several controls in
function alvium_ctrl_init and uses the returned pointer without check. That
can cause write access over NULL-pointer for several controls. The reworked
code checks the pointers before adding flags.

Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Hecht <mhecht73@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
index 955b7072a5605e3c52b6e8896dbb37613dd8317a..dd991c2ee7002903ad7833f4309ff6aa3ea688e1 100644 (file)
--- a/drivers/media/i2c/alvium-csi2.c
+++ b/drivers/media/i2c/alvium-csi2.c
@@ -2100,20 +2100,21 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
                                              V4L2_CID_PIXEL_RATE, 0,
                                              ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1,
                                              ALVIUM_DEFAULT_PIXEL_RATE_MHZ);
-       ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
 
        /* Link freq is fixed */
        ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops,
                                                  V4L2_CID_LINK_FREQ,
                                                  0, 0, &alvium->link_freq);
-       ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+       if (ctrls->link_freq)
+               ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
 
        /* Auto/manual white balance */
        if (alvium->avail_ft.auto_whiteb) {
                ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops,
                                                   V4L2_CID_AUTO_WHITE_BALANCE,
                                                   0, 1, 1, 1);
-               v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
+               if (ctrls->auto_wb)
+                       v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
        }
 
        ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
@@ -2122,6 +2123,7 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
                                                alvium->max_bbalance,
                                                alvium->inc_bbalance,
                                                alvium->dft_bbalance);
+
        ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
                                               V4L2_CID_RED_BALANCE,
                                               alvium->min_rbalance,
@@ -2136,7 +2138,9 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
                                               V4L2_CID_EXPOSURE_AUTO,
                                               V4L2_EXPOSURE_MANUAL, 0,
                                               V4L2_EXPOSURE_AUTO);
-               v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
+               if (ctrls->auto_exp)
+                       v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp,
+                                              V4L2_EXPOSURE_MANUAL, true);
        }
 
        ctrls->exposure = v4l2_ctrl_new_std(hdl, ops,
@@ -2145,14 +2149,16 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
                                            alvium->max_exp,
                                            alvium->inc_exp,
                                            alvium->dft_exp);
-       ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
+       if (ctrls->exposure)
+               ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
 
        /* Auto/manual gain */
        if (alvium->avail_ft.auto_gain) {
                ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
                                                     V4L2_CID_AUTOGAIN,
                                                     0, 1, 1, 1);
-               v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
+               if (ctrls->auto_gain)
+                       v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
        }
 
        if (alvium->avail_ft.gain) {
@@ -2162,7 +2168,8 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
                                                alvium->max_gain,
                                                alvium->inc_gain,
                                                alvium->dft_gain);
-               ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+               if (ctrls->gain)
+                       ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
        }
 
        if (alvium->avail_ft.sat)