From 7c3bae3f430af6b4fcbdb7272e191e266fd94b45 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Tue, 3 Mar 2020 12:01:59 +0100 Subject: [PATCH] media: v4l2-ctrls: v4l2_ctrl_g/s_ctrl*(): don't continue when WARN_ON If the v4l2_ctrl_g_ctrl*() or __v4l2_ctrl_s_ctrl*() functions are called for the wrong control type then they call WARN_ON since that is a driver error. But they still continue, potentially overwriting data. Change this to return an error (s_ctrl) or 0 (g_ctrl), just to be safe. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/v4l2-ctrls.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c index 0186ba8..77b0132 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls.c +++ b/drivers/media/v4l2-core/v4l2-ctrls.c @@ -3799,7 +3799,8 @@ s32 v4l2_ctrl_g_ctrl(struct v4l2_ctrl *ctrl) struct v4l2_ext_control c; /* It's a driver bug if this happens. */ - WARN_ON(!ctrl->is_int); + if (WARN_ON(!ctrl->is_int)) + return 0; c.value = 0; get_ctrl(ctrl, &c); return c.value; @@ -3811,7 +3812,8 @@ s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl) struct v4l2_ext_control c; /* It's a driver bug if this happens. */ - WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64); + if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64)) + return 0; c.value64 = 0; get_ctrl(ctrl, &c); return c.value64; @@ -4220,7 +4222,8 @@ int __v4l2_ctrl_s_ctrl(struct v4l2_ctrl *ctrl, s32 val) lockdep_assert_held(ctrl->handler->lock); /* It's a driver bug if this happens. */ - WARN_ON(!ctrl->is_int); + if (WARN_ON(!ctrl->is_int)) + return -EINVAL; ctrl->val = val; return set_ctrl(NULL, ctrl, 0); } @@ -4231,7 +4234,8 @@ int __v4l2_ctrl_s_ctrl_int64(struct v4l2_ctrl *ctrl, s64 val) lockdep_assert_held(ctrl->handler->lock); /* It's a driver bug if this happens. */ - WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64); + if (WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64)) + return -EINVAL; *ctrl->p_new.p_s64 = val; return set_ctrl(NULL, ctrl, 0); } @@ -4242,7 +4246,8 @@ int __v4l2_ctrl_s_ctrl_string(struct v4l2_ctrl *ctrl, const char *s) lockdep_assert_held(ctrl->handler->lock); /* It's a driver bug if this happens. */ - WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING); + if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_STRING)) + return -EINVAL; strscpy(ctrl->p_new.p_char, s, ctrl->maximum + 1); return set_ctrl(NULL, ctrl, 0); } @@ -4254,7 +4259,8 @@ int __v4l2_ctrl_s_ctrl_area(struct v4l2_ctrl *ctrl, lockdep_assert_held(ctrl->handler->lock); /* It's a driver bug if this happens. */ - WARN_ON(ctrl->type != V4L2_CTRL_TYPE_AREA); + if (WARN_ON(ctrl->type != V4L2_CTRL_TYPE_AREA)) + return -EINVAL; *ctrl->p_new.p_area = *area; return set_ctrl(NULL, ctrl, 0); } -- 2.7.4