media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()

If CONFIG_MEDIA_CONTROLLER is undefined, media_request_object_find() will
always return NULL, so its 2nd call in v4l2_ctrl_request_complete() would
fail as well as the 1st one and thus cause hdl to have a wrong value (at
the top of memory) and list_for_each_entry() to iterate over the garbage
data located there. Add NULL check for the 2nd call and place the error
cleanup at the end of v4l2_ctrl_request_complete()...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: c3bf5129f339 ("media: v4l2-ctrls: always copy the controls on completion")
Cc: stable@vger.kernel.org
Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/v4l2-core/v4l2-ctrls-request.c b/drivers/media/v4l2-core/v4l2-ctrls-request.c
index 4b7e6981b8d6f591dfae9acd38214586c4a26e11..5c2fc767c6a61886dae308755eb8b5a983609bb3 100644 (file)
--- a/drivers/media/v4l2-core/v4l2-ctrls-request.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-request.c
@@ -348,13 +348,12 @@ void v4l2_ctrl_request_complete(struct media_request *req,
                ret = v4l2_ctrl_handler_init(hdl, (main_hdl->nr_of_buckets - 1) * 8);
                if (!ret)
                        ret = v4l2_ctrl_request_bind(req, hdl, main_hdl);
-               if (ret) {
-                       v4l2_ctrl_handler_free(hdl);
-                       kfree(hdl);
-                       return;
-               }
+               if (ret)
+                       goto error;
                hdl->request_is_queued = true;
                obj = media_request_object_find(req, &req_ops, main_hdl);
+               if (!obj)
+                       goto error;
        }
        hdl = container_of(obj, struct v4l2_ctrl_handler, req_obj);
 
@@ -389,6 +388,11 @@ void v4l2_ctrl_request_complete(struct media_request *req,
        mutex_unlock(main_hdl->lock);
        media_request_object_complete(obj);
        media_request_object_put(obj);
+       return;
+
+error:
+       v4l2_ctrl_handler_free(hdl);
+       kfree(hdl);
 }
 EXPORT_SYMBOL(v4l2_ctrl_request_complete);