Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Janusz Krzysztofik <jmkrzyszt@gmail.com>
To:     Mauro Carvalho Chehab <mchehab@kernel.org>
Cc:     Sakari Ailus <sakari.ailus@linux.intel.com>,
        Hans Verkuil <hans.verkuil@cisco.com>,
        linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org, Janusz Krzysztofik <jmkrzyszt@gmail.com>
Subject: [PATCH 07/14] media: ov6650: Fix unverified pad IDs accepted by .g/s_frame_interval()
Date:   Mon,  8 Apr 2019 23:42:35 +0200
Message-Id: <20190408214242.9603-8-jmkrzyszt@gmail.com>
In-Reply-To: <20190408214242.9603-1-jmkrzyszt@gmail.com>
References: <20190408214242.9603-1-jmkrzyszt@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Commit 4471109e3894 ("media: convert g/s_parm to g/s_frame_interval in
subdevs") comverted former ov6650_g/s_parm() video_operation_callbacks
to ov6650_g/s_frame_interval() pad operation callbacks.  Howeveer, the
new functions don't verify correcntess of pad IDs passed in user
arguments.  Fix it.

Even if pad ID arguments are not actually used in those functions,
assumed to be 0, always return -EINVAL if an operation on an invalid
(non-zero) pad is requested by a user.

Fixes: 4471109e3894 ("media: convert g/s_parm to g/s_frame_interval in subdevs")
Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
Cc: stable@vger.kernel.org
---
 drivers/media/i2c/ov6650.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
index 5df81dec06ae..1daef0c7ad91 100644
--- a/drivers/media/i2c/ov6650.c
+++ b/drivers/media/i2c/ov6650.c
@@ -770,6 +770,9 @@ static int ov6650_g_frame_interval(struct v4l2_subdev *sd,
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 	struct ov6650 *priv = to_ov6650(client);
 
+	if (ival->pad)
+		return -EINVAL;
+
 	ival->interval.numerator = GET_CLKRC_DIV(to_clkrc(&priv->tpf,
 			priv->pclk_limit, priv->pclk_max));
 	ival->interval.denominator = FRAME_RATE_MAX;
@@ -789,6 +792,9 @@ static int ov6650_s_frame_interval(struct v4l2_subdev *sd,
 	int div, ret;
 	u8 clkrc;
 
+	if (ival->pad)
+		return -EINVAL;
+
 	if (tpf->numerator == 0 || tpf->denominator == 0)
 		div = 1;  /* Reset to full rate */
 	else
-- 
2.21.0