Commit bab222e2 authored by Abhishek Tamboli's avatar Abhishek Tamboli Committed by Heyuan Wang
Browse files

usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c 

mainline inclusion
from mainline-v6.12-rc1
commit a7bb96b18864225a694e3887ac2733159489e4b0
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRHZ
CVE: CVE-2024-50056

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a7bb96b18864225a694e3887ac2733159489e4b0



--------------------------------

Fix potential dereferencing of ERR_PTR() in find_format_by_pix()
and uvc_v4l2_enum_format().

Fix the following smatch errors:

drivers/usb/gadget/function/uvc_v4l2.c:124 find_format_by_pix()
error: 'fmtdesc' dereferencing possible ERR_PTR()

drivers/usb/gadget/function/uvc_v4l2.c:392 uvc_v4l2_enum_format()
error: 'fmtdesc' dereferencing possible ERR_PTR()

Also, fix similar issue in uvc_v4l2_try_format() for potential
dereferencing of ERR_PTR().

Signed-off-by: default avatarAbhishek Tamboli <abhishektamboli9@gmail.com>
Link: https://lore.kernel.org/r/20240815102202.594812-1-abhishektamboli9@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarHeyuan Wang <wangheyuan2@h-partners.com>
parent 1da97219

drivers/usb/gadget/function/uvc_v4l2.c

+11 −1
Original line number Diff line number Diff line
@@ -121,6 +121,9 @@ static struct uvcg_format *find_format_by_pix(struct uvc_device *uvc, 
	list_for_each_entry(format, &uvc->header->formats, entry) {

		const struct uvc_format_desc *fmtdesc = to_uvc_format(format->fmt);



		if (IS_ERR(fmtdesc))

			continue;



		if (fmtdesc->fcc == pixelformat) {

			uformat = format->fmt;

			break;
@@ -240,6 +243,7 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) 
	struct uvc_video *video = &uvc->video;

	struct uvcg_format *uformat;

	struct uvcg_frame *uframe;

	const struct uvc_format_desc *fmtdesc;

	u8 *fcc;



	if (fmt->type != video->queue.queue.type)
@@ -277,7 +281,10 @@ uvc_v4l2_try_format(struct file *file, void *fh, struct v4l2_format *fmt) 
		fmt->fmt.pix.height = uframe->frame.w_height;

		fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(uformat, uframe);

		fmt->fmt.pix.sizeimage = uvc_get_frame_size(uformat, uframe);

		fmt->fmt.pix.pixelformat = to_uvc_format(uformat)->fcc;

		fmtdesc = to_uvc_format(uformat);

		if (IS_ERR(fmtdesc))

			return PTR_ERR(fmtdesc);

		fmt->fmt.pix.pixelformat = fmtdesc->fcc;

	}

	fmt->fmt.pix.field = V4L2_FIELD_NONE;

	fmt->fmt.pix.colorspace = V4L2_COLORSPACE_SRGB;
@@ -389,6 +396,9 @@ uvc_v4l2_enum_format(struct file *file, void *fh, struct v4l2_fmtdesc *f) 
		return -EINVAL;



	fmtdesc = to_uvc_format(uformat);

	if (IS_ERR(fmtdesc))

		return PTR_ERR(fmtdesc);



	f->pixelformat = fmtdesc->fcc;



	return 0;