Received: by 2002:a05:6512:2355:0:0:0:0 with SMTP id p21csp5526709lfu; Mon, 28 Mar 2022 16:01:03 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz3iTdvHw7hNm9jZR0TXOQ2p+azEtRJXszfVkKEYKF/dOthmZCT/VMjDM2Y3vvo1VNKQjR7 X-Received: by 2002:a05:620a:15ad:b0:67e:2fd2:35c4 with SMTP id f13-20020a05620a15ad00b0067e2fd235c4mr18228549qkk.487.1648508463210; Mon, 28 Mar 2022 16:01:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1648508463; cv=none; d=google.com; s=arc-20160816; b=mJ36k3RoQ4LNBGL6P1OS/8NHCdKUVTWOqzYaf2dU1xVJKZJ4ttwSqI7F7BhO5LWGHj k0PjqDnIf2ydJR8fyAH4keKVcCr3qg5+ov1ZB264MxBd1KfCx9sfr5oISSsE5hz1995w szUcpgnRapMDrr09FSIjvcfSB0cmG5q8srLWBOBEn9kyRLQ5bhDWLryOgVqH6AjVDLkV iLebfg3i42HPJrjst8slDVmI//eSPpjd0irmgkX9GFQQGmM9Ti5SGrgd9UB2+o3pjriH r4pMRpAVtA+auOFOzaFbQh0PiR2ZJ3Qx5FPta743WW42a1GD0Rg7mQfCeECEdcKEGbG9 /iZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=v/zSPqmwF724vuIgv1AiC9fqBd4XFYW22ARZzgRtCYM=; b=Um/a64cMS5N9kWe24j/542CwHn4uKXl6ta1J0dvEYoC0Xv5dDq8VBNKrhso+Fo5ePw FsA43sXb6CcEA+Ug0J0NDylWrpq5LCNrrh1JbSviw0Tq4u38A7AB0v+4+9sLZEs1/lAz a9jXWwdwh7FV2hpnHr8F+5BbUWHqmMQBwBpdzQY3vdFh+OsUnZf0PKsLKTPF7dmbbWAf pySJ0TlBQxJJ1dqe9rFInSpteDpuFyDAcEVeMAxuuD+q0MBrFMusaBTy/Xae+e/FiXAb c+gdc63WEjzRQSaxuxww4r9/VDw2qo/NngKYlmymGD6c05QAubd3/pqSHnSpjRWozXsq NiyA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=N5tMMfS8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [2620:137:e000::1:18]) by mx.google.com with ESMTPS id x11-20020a67ae0b000000b00325764006c2si3373512vse.713.2022.03.28.16.01.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Mar 2022 16:01:03 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=N5tMMfS8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 5D8FD28AC65; Mon, 28 Mar 2022 15:00:21 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230238AbiC1VBl (ORCPT + 99 others); Mon, 28 Mar 2022 17:01:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229450AbiC1VBj (ORCPT ); Mon, 28 Mar 2022 17:01:39 -0400 Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 650426EB13 for ; Mon, 28 Mar 2022 13:59:56 -0700 (PDT) Received: by mail-ed1-x534.google.com with SMTP id r23so18428635edb.0 for ; Mon, 28 Mar 2022 13:59:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=v/zSPqmwF724vuIgv1AiC9fqBd4XFYW22ARZzgRtCYM=; b=N5tMMfS8Hfv3JbwfarORQ4RfR5BUoj/Y+Fkrzm3vA1qhiDTAl5B/TeKmEX3yZMIJhG u37j3CWzKQbtgrx/3s/nn757RUoUX7YmLhHMxp1ACXrI7doAQVeVylamgFwKHSwrDUNb FUp7trRflJN1tdcUzSkOZCw9fHT1KXstAUSzc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=v/zSPqmwF724vuIgv1AiC9fqBd4XFYW22ARZzgRtCYM=; b=l8K/R5nu+iLYtoyfpufXV1so++OI4W3rAYHrOTvF7OoAnf27nVFQEWdr+5OTZ+Hkoi FAfdevxa53B3tmcoWt6qIQpIPc5b5SL5q0X3STekDc4hmVJFTC6QayH0fEgROBAL10dv is4MGHB6QEFu4j+aWLcyNH111CO1fGl9+hIHJh1AaXJEJ59q/Swhkbuj2SGp8eLJv2wG 3JW4KGPHelVeIYU6xcgasv3vX3jjb5S43Un0Gu2Mhg2TOXNud8N2wVvYD67QEmZ+pvIz 7RtHgW5rbZ7sG3oZ4GYE4hxVPrXUWEDCnBsKkJIOt5bP5FIZVanyzdc2D11HzcLVMgyn SjCA== X-Gm-Message-State: AOAM532C6XzTZ/GiT5vhMH5H0PZ1586Q0jIlP63Bd3EXvavzfBdNG/7s KJIMrAhMk1HPT0wXDK2snwZJoQ== X-Received: by 2002:a50:9986:0:b0:413:bbdd:d5a1 with SMTP id m6-20020a509986000000b00413bbddd5a1mr18792517edb.26.1648501194995; Mon, 28 Mar 2022 13:59:54 -0700 (PDT) Received: from alco.lan (80.71.134.83.ipv4.parknet.dk. [80.71.134.83]) by smtp.gmail.com with ESMTPSA id hq39-20020a1709073f2700b006dfc58efab9sm6462259ejc.73.2022.03.28.13.59.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Mar 2022 13:59:54 -0700 (PDT) From: Ricardo Ribalda To: Laurent Pinchart , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Ricardo Ribalda , syzbot Subject: [PATCH] media: uvc: Handle cameras with invalid descriptors Date: Mon, 28 Mar 2022 22:59:52 +0200 Message-Id: <20220328205952.584407-1-ribalda@chromium.org> X-Mailer: git-send-email 2.35.1.1021.g381101b075-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If the source entity does not contain any pads, do not create a link. Reported-by: syzbot Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_entity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c index 7c4d2f93d351..1f730cb72e58 100644 --- a/drivers/media/usb/uvc/uvc_entity.c +++ b/drivers/media/usb/uvc/uvc_entity.c @@ -43,7 +43,7 @@ static int uvc_mc_create_links(struct uvc_video_chain *chain, source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING) ? (remote->vdev ? &remote->vdev->entity : NULL) : &remote->subdev.entity; - if (source == NULL) + if (source == NULL || source->num_pads == 0) continue; remote_pad = remote->num_pads - 1; -- 2.35.1.1021.g381101b075-goog