Unverified Commit 939958aa authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13140 CVE-2024-50056 

Merge Pull Request from: @ci-robot 
 
PR sync from: Heyuan Wang <wangheyuan2@h-partners.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/XMYPQTN2CYSI6EX7LREP3KEXVQOUWG7D/ 
Abhishek Tamboli (1):
  usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c

Michael Grzeschik (1):
  usb: gadget: uvc: fix try format returns on uncompressed formats


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAYRHZ 
 
Link:https://gitee.com/openeuler/kernel/pulls/13140

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 19640fb0 bab222e2

drivers/usb/gadget/function/uvc_v4l2.c

+29 −5
Original line number Diff line number Diff line
@@ -121,6 +121,9 @@ static struct uvcg_format *find_format_by_pix(struct uvc_device *uvc, 
	list_for_each_entry(format, &uvc->header->formats, entry) {

		const struct uvc_format_desc *fmtdesc = to_uvc_format(format->fmt);



		if (IS_ERR(fmtdesc))

			continue;



		if (fmtdesc->fcc == pixelformat) {

			uformat = format->fmt;

			break;
@@ -240,6 +243,7 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) 
	struct uvc_video *video = &uvc->video;

	struct uvcg_format *uformat;

	struct uvcg_frame *uframe;

	const struct uvc_format_desc *fmtdesc;

	u8 *fcc;



	if (fmt->type != video->queue.queue.type)
@@ -260,12 +264,29 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) 
	if (!uframe)

		return -EINVAL;



	if (uformat->type == UVCG_UNCOMPRESSED) {

		struct uvcg_uncompressed *u =

			to_uvcg_uncompressed(&uformat->group.cg_item);

		if (!u)

			return 0;



		v4l2_fill_pixfmt(&fmt->fmt.pix, fmt->fmt.pix.pixelformat,

				 uframe->frame.w_width, uframe->frame.w_height);



		if (fmt->fmt.pix.sizeimage != (uvc_v4l2_get_bytesperline(uformat, uframe) *

						uframe->frame.w_height))

			return -EINVAL;

	} else {

		fmt->fmt.pix.width = uframe->frame.w_width;

		fmt->fmt.pix.height = uframe->frame.w_height;

	fmt->fmt.pix.field = V4L2_FIELD_NONE;

		fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(uformat, uframe);

		fmt->fmt.pix.sizeimage = uvc_get_frame_size(uformat, uframe);

	fmt->fmt.pix.pixelformat = to_uvc_format(uformat)->fcc;

		fmtdesc = to_uvc_format(uformat);

		if (IS_ERR(fmtdesc))

			return PTR_ERR(fmtdesc);

		fmt->fmt.pix.pixelformat = fmtdesc->fcc;

	}

	fmt->fmt.pix.field = V4L2_FIELD_NONE;

	fmt->fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;

	fmt->fmt.pix.priv = 0;
@@ -375,6 +396,9 @@ uvc_v4l2_enum_format(struct file *file, void *fh, struct v4l2_fmtdesc *f) 
		return -EINVAL;



	fmtdesc = to_uvc_format(uformat);

	if (IS_ERR(fmtdesc))

		return PTR_ERR(fmtdesc);



	f->pixelformat = fmtdesc->fcc;



	return 0;