Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Janusz Krzysztofik <jmkrzyszt@gmail.com>
To:     Mauro Carvalho Chehab <mchehab@kernel.org>
Cc:     Sakari Ailus <sakari.ailus@linux.intel.com>,
        Hans Verkuil <hans.verkuil@cisco.com>,
        linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org, Janusz Krzysztofik <jmkrzyszt@gmail.com>
Subject: [PATCH 06/14] media: ov6650: Fix unverified pad IDs accepted by .get/set_selectioon()
Date:   Mon,  8 Apr 2019 23:42:34 +0200
Message-Id: <20190408214242.9603-7-jmkrzyszt@gmail.com>
In-Reply-To: <20190408214242.9603-1-jmkrzyszt@gmail.com>
References: <20190408214242.9603-1-jmkrzyszt@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Commit 10d5509c8d50 ("[media] v4l2: remove g/s_crop from video ops")
converted former ov6650_g/s_crop() video operation callbacks to
ov6650_get/set_selection() pad operation callbacks.  However, the new
functions don't verify correctness of pad IDs passed in user arguments.
Fix it.

Even if pad ID arguments are not actually used in those functions,
assumed to be 0, always return -EINVAL if an operation on an invalid
(non-zero) pad is requested by a user.

Fixes: 10d5509c8d50 ("[media] v4l2: remove g/s_crop from video ops")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Cc: stable@vger.kernel.org
---
 drivers/media/i2c/ov6650.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
index d72fcf56930a..5df81dec06ae 100644
--- a/drivers/media/i2c/ov6650.c
+++ b/drivers/media/i2c/ov6650.c
@@ -444,6 +444,9 @@ static int ov6650_get_selection(struct v4l2_subdev *sd,
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 	struct ov6650 *priv = to_ov6650(client);
 
+	if (sel->pad)
+		return -EINVAL;
+
 	if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE)
 		return -EINVAL;
 
@@ -471,6 +474,9 @@ static int ov6650_set_selection(struct v4l2_subdev *sd,
 	struct v4l2_rect rect = sel->r;
 	int ret;
 
+	if (sel->pad)
+		return -EINVAL;
+
 	if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE ||
 	    sel->target != V4L2_SEL_TGT_CROP)
 		return -EINVAL;
-- 
2.21.0