[PATCH] media: i2c: imx283: reject unsupported mbus codes in set_fmt/set_ctrl

[PATCH] media: i2c: imx283: reject unsupported mbus codes in set_fmt/set_ctrl

[Guo Zihao]

imx283_set_ctrl() and imx283_set_pad_format() call get_mode_table()
with an mbus code that userspace controls.  For codes outside the
supported 12-bit/10-bit list get_mode_table() leaves mode_list NULL
and num_modes 0, and v4l2_find_nearest_size() returns NULL for an
empty list, so the immediate dereference of mode->width oopses:

        get_mode_table(fmt->format.code, &mode_list, &num_modes);
        mode = v4l2_find_nearest_size(mode_list, num_modes, ...);
        fmt->format.width = mode->width;      /* NULL deref */

imx283_set_pad_format() is reachable with an arbitrary code through
VIDIOC_SUBDEV_S_FMT on /dev/v4l-subdevX, making the crash triggerable
by any local user with access to the media device node.  The same
pattern exists in imx283_set_ctrl() via the format stored in the
subdev state.

Bail out with -EINVAL when get_mode_table() yields no modes, matching
the upfront code validation other imx drivers perform.

Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
 drivers/media/i2c/imx283.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/i2c/imx283.c b/drivers/media/i2c/imx283.c
index 38ea1902f..2c9af6e13 100644
--- a/drivers/media/i2c/imx283.c
+++ b/drivers/media/i2c/imx283.c
@@ -767,6 +767,9 @@ static int imx283_set_ctrl(struct v4l2_ctrl *ctrl)
 	fmt = v4l2_subdev_state_get_format(state, 0);
 
 	get_mode_table(fmt->code, &mode_list, &num_modes);
+	if (!num_modes || !mode_list)
+		return -EINVAL;
+
 	mode = v4l2_find_nearest_size(mode_list, num_modes, width, height,
 				      fmt->width, fmt->height);
 
@@ -968,6 +971,8 @@ static int imx283_set_pad_format(struct v4l2_subdev *sd,
 	unsigned int num_modes;
 
 	get_mode_table(fmt->format.code, &mode_list, &num_modes);
+	if (!num_modes || !mode_list)
+		return -EINVAL;
 
 	mode = v4l2_find_nearest_size(mode_list, num_modes, width, height,
 				      fmt->format.width, fmt->format.height);
-- 
2.50.1