media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator
authorXiaomeng Tong <xiam0nd.tong@gmail.com>
Thu, 14 Apr 2022 04:14:15 +0000 (05:14 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 Aug 2022 12:22:57 +0000 (14:22 +0200)
commit74d64284538e3f7cc3a90666f88ebcad5ed74890
tree94c162fdef73118bc024d4c0164a48785bbc9ad2
parentddc7fadd05042dd09f3ca33db7fc6e86cb1daa0f
media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator

commit 09b204eb9de9fdf07d028c41c4331b5cfeb70dd7 upstream.

The three bugs are here:
__func__, s3a_buf->s3a_data->exp_id);
__func__, md_buf->metadata->exp_id);
__func__, dis_buf->dis_data->exp_id);

The list iterator 's3a_buf/md_buf/dis_buf' will point to a bogus
position containing HEAD if the list is empty or no element is found.
This case must be checked before any use of the iterator, otherwise
it will lead to a invalid memory access.

To fix this bug, add an check. Use a new variable '*_iter' as the
list iterator, while use the old variable '*_buf' as a dedicated
pointer to point to the found element.

Link: https://lore.kernel.org/linux-media/20220414041415.3342-1-xiam0nd.tong@gmail.com
Cc: stable@vger.kernel.org
Fixes: ad85094b293e4 ("Revert "media: staging: atomisp: Remove driver"")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/media/atomisp/pci/atomisp_cmd.c