* [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
@ 2026-09-17 3:37 Rokinthan p
2026-09-22 14:51 ` Hans Verkuil
0 siblings, 1 reply; 6+ messages in thread
From: Rokinthan p @ 2026-09-17 3:37 UTC (permalink / raw)
To: Hans Verkuil
Cc: Mauro Carvalho Chehab, linux-media, linux-kernel,
syzbot+9f7405999979761b6cfc
[-- Attachment #1: Type: text/plain, Size: 4276 bytes --]
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at
v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
v2 -> v3:
- Fix the issue in the V4L2 core (v4l2-ctrls-core.c) instead of hackrf,
as suggested by Hans Verkuil.
- Return early if controls[0] == NULL in both v4l2_ctrl_cluster() and
v4l2_ctrl_auto_cluster().
- Update function documentation in include/media/v4l2-ctrls.h.
- Revert hackrf driver changes.
v1 -> v2:
- Corrected commit hash in Fixes tag.
drivers/media/v4l2-core/v4l2-ctrls-core.c | 16 ++++++++++++----
include/media/v4l2-ctrls.h | 4 ++++
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-
core/v4l2-ctrls-core.c
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2490,7 +2490,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct
v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be
NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2508,12 +2511,17 @@ EXPORT_SYMBOL(v4l2_ctrl_cluster);
void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl
**controls,
u8 manual_val, bool set_volatile)
{
- struct v4l2_ctrl *master = controls[0];
+ struct v4l2_ctrl *master;
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!controls[0])
+ return;
+
+ master = controls[0];
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,8 @@ struct v4l2_ctrl_config {
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and
just returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl
**controls);
@@ -868,6 +870,8 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct
v4l2_ctrl **controls);
* In addition, this function will set the %V4L2_CTRL_FLAG_UPDATE flag
* on the autofoo control and %V4L2_CTRL_FLAG_INACTIVE on the foo
control(s)
* if autofoo is in auto mode.
+ *
+ * If controls[0] is NULL, then this function does nothing and
just returns.
*/
void v4l2_ctrl_auto_cluster(unsigned int ncontrols,
struct v4l2_ctrl **controls,
[-- Attachment #2: 0001-media-v4l2-ctrls-do-nothing-if-controls-0-is-NULL-in.patch --]
[-- Type: text/x-patch, Size: 4009 bytes --]
From: Rohinthan <rokinthanp03@gmail.com>
Subject: [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
Date: Fri, 11 Sep 2026 18:55:00 +0530
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
v2 -> v3:
- Fix the issue in the V4L2 core (v4l2-ctrls-core.c) instead of hackrf,
as suggested by Hans Verkuil.
- Return early if controls[0] == NULL in both v4l2_ctrl_cluster() and
v4l2_ctrl_auto_cluster().
- Update function documentation in include/media/v4l2-ctrls.h.
- Revert hackrf driver changes.
v1 -> v2:
- Corrected commit hash in Fixes tag.
drivers/media/v4l2-core/v4l2-ctrls-core.c | 16 ++++++++++++----
include/media/v4l2-ctrls.h | 4 ++++
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2490,7 +2490,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2508,12 +2511,17 @@ EXPORT_SYMBOL(v4l2_ctrl_cluster);
void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
u8 manual_val, bool set_volatile)
{
- struct v4l2_ctrl *master = controls[0];
+ struct v4l2_ctrl *master;
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!controls[0])
+ return;
+
+ master = controls[0];
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,8 @@ struct v4l2_ctrl_config {
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and just returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
@@ -868,6 +870,8 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
* In addition, this function will set the %V4L2_CTRL_FLAG_UPDATE flag
* on the autofoo control and %V4L2_CTRL_FLAG_INACTIVE on the foo control(s)
* if autofoo is in auto mode.
+ *
+ * If controls[0] is NULL, then this function does nothing and just returns.
*/
void v4l2_ctrl_auto_cluster(unsigned int ncontrols,
struct v4l2_ctrl **controls,
--
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
2026-09-17 3:37 [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Rokinthan p
@ 2026-09-22 14:51 ` Hans Verkuil
2026-09-23 1:01 ` Rohinthan P
0 siblings, 1 reply; 6+ messages in thread
From: Hans Verkuil @ 2026-09-22 14:51 UTC (permalink / raw)
To: Rokinthan p
Cc: Mauro Carvalho Chehab, linux-media, linux-kernel,
syzbot+9f7405999979761b6cfc
On 17/09/2026 05:37, Rokinthan p wrote:
> The V4L2 control framework is designed to allow drivers to instantiate
> controls and clusters without checking for errors after each call,
> checking hdl->error only once at the end.
>
> However, if allocating the master control (controls[0]) fails, e.g. due to
> memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
> ncontrols == 0 || controls[0] == NULL
> WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at
> v4l2_ctrl_cluster
>
> Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
> master->minimum without checking if controls[0] is NULL, leading to a
> NULL pointer dereference when master control creation fails.
>
> Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
> return if controls[0] is NULL, preserving the design that control
> creation errors are caught at the end when the driver checks hdl->error.
> Also update function documentation in include/media/v4l2-ctrls.h.
>
> Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
> Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
> Suggested-by: Hans Verkuil <hverkuil@kernel.org>
> Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
This says Rohinthan, but your email says 'Rokinthan p', what is correct?
Also, why do you have a 'Reply-To: www.rokinthanp03@gmail.com' field? That's
not going to work.
Regards,
Hans
> ---
> v2 -> v3:
> - Fix the issue in the V4L2 core (v4l2-ctrls-core.c) instead of hackrf,
> as suggested by Hans Verkuil.
> - Return early if controls[0] == NULL in both v4l2_ctrl_cluster() and
> v4l2_ctrl_auto_cluster().
> - Update function documentation in include/media/v4l2-ctrls.h.
> - Revert hackrf driver changes.
>
> v1 -> v2:
> - Corrected commit hash in Fixes tag.
>
> drivers/media/v4l2-core/v4l2-ctrls-core.c | 16 ++++++++++++----
> include/media/v4l2-ctrls.h | 4 ++++
> 2 files changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-
> core/v4l2-ctrls-core.c
> --- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
> +++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
> @@ -2490,7 +2490,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct
> v4l2_ctrl **controls)
> int i;
>
> /* The first control is the master control and it must not be
> NULL */
> - if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
> + if (WARN_ON(ncontrols == 0))
> + return;
> +
> + if (!controls[0])
> return;
>
> for (i = 0; i < ncontrols; i++) {
> @@ -2508,12 +2511,17 @@ EXPORT_SYMBOL(v4l2_ctrl_cluster);
> void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl
> **controls,
> u8 manual_val, bool set_volatile)
> {
> - struct v4l2_ctrl *master = controls[0];
> + struct v4l2_ctrl *master;
> u32 flag = 0;
> int i;
>
> + if (WARN_ON(ncontrols <= 1))
> + return;
> +
> + if (!controls[0])
> + return;
> +
> + master = controls[0];
> v4l2_ctrl_cluster(ncontrols, controls);
> - WARN_ON(ncontrols <= 1);
> WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
> WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
> master->is_auto = true;
> diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
> --- a/include/media/v4l2-ctrls.h
> +++ b/include/media/v4l2-ctrls.h
> @@ -834,6 +834,8 @@ struct v4l2_ctrl_config {
> *
> * @ncontrols: The number of controls in this cluster.
> * @controls: The cluster control array of size @ncontrols.
> + *
> + * If controls[0] is NULL, then this function does nothing and
> just returns.
> */
> void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl
> **controls);
>
> @@ -868,6 +870,8 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct
> v4l2_ctrl **controls);
> * In addition, this function will set the %V4L2_CTRL_FLAG_UPDATE flag
> * on the autofoo control and %V4L2_CTRL_FLAG_INACTIVE on the foo
> control(s)
> * if autofoo is in auto mode.
> + *
> + * If controls[0] is NULL, then this function does nothing and
> just returns.
> */
> void v4l2_ctrl_auto_cluster(unsigned int ncontrols,
> struct v4l2_ctrl **controls,
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
2026-09-22 14:51 ` Hans Verkuil
@ 2026-09-23 1:01 ` Rohinthan P
2026-09-23 7:21 ` Hans Verkuil
0 siblings, 1 reply; 6+ messages in thread
From: Rohinthan P @ 2026-09-23 1:01 UTC (permalink / raw)
To: Hans Verkuil
Cc: Mauro Carvalho Chehab, linux-media, linux-kernel,
syzbot+9f7405999979761b6cfc
Hi Hans,
Thank you for reviewing the patch!
1. Regarding my name:
My correct name is "Rohinthan P". I have updated my email display name
and git configuration so that Author and Signed-off-by consistently match.
2. Regarding the 'Reply-To' header:
That was an accidental typo in my Gmail web settings where 'www.' was
mistakenly prefixed to the address. I have fixed and removed that setting.
Please let me know if you would like me to resubmit a [PATCH v4] with the
updated Author and Signed-off-by lines, or if you can apply v3 directly
with the name "Rohinthan P <rokinthanp03@gmail.com>".
Thanks,
Rohinthan P
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
2026-09-23 1:01 ` Rohinthan P
@ 2026-09-23 7:21 ` Hans Verkuil
0 siblings, 0 replies; 6+ messages in thread
From: Hans Verkuil @ 2026-09-23 7:21 UTC (permalink / raw)
To: Rohinthan P
Cc: Mauro Carvalho Chehab, linux-media, linux-kernel,
syzbot+9f7405999979761b6cfc
On 23/09/2026 03:01, Rohinthan P wrote:
> Hi Hans,
>
> Thank you for reviewing the patch!
>
> 1. Regarding my name:
> My correct name is "Rohinthan P". I have updated my email display name
> and git configuration so that Author and Signed-off-by consistently match.
>
> 2. Regarding the 'Reply-To' header:
> That was an accidental typo in my Gmail web settings where 'www.' was
> mistakenly prefixed to the address. I have fixed and removed that setting.
>
> Please let me know if you would like me to resubmit a [PATCH v4] with the
> updated Author and Signed-off-by lines, or if you can apply v3 directly
> with the name "Rohinthan P <rokinthanp03@gmail.com>".
No need for a v4, I can make the changes. Thank you for clarifying this.
Regards,
Hans
>
> Thanks,
> Rohinthan P
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
@ 2026-09-17 3:42 Rokinthan p
0 siblings, 0 replies; 6+ messages in thread
From: Rokinthan p @ 2026-09-17 3:42 UTC (permalink / raw)
To: linux-kernel
Cc: Hans Verkuil, syzbot+9f7405999979761b6cfc, linux-media,
Mauro Carvalho Chehab, syzbot+cf896de36144391bcde1
[-- Attachment #1: Type: text/plain, Size: 4276 bytes --]
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at
v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
v2 -> v3:
- Fix the issue in the V4L2 core (v4l2-ctrls-core.c) instead of hackrf,
as suggested by Hans Verkuil.
- Return early if controls[0] == NULL in both v4l2_ctrl_cluster() and
v4l2_ctrl_auto_cluster().
- Update function documentation in include/media/v4l2-ctrls.h.
- Revert hackrf driver changes.
v1 -> v2:
- Corrected commit hash in Fixes tag.
drivers/media/v4l2-core/v4l2-ctrls-core.c | 16 ++++++++++++----
include/media/v4l2-ctrls.h | 4 ++++
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-
core/v4l2-ctrls-core.c
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2490,7 +2490,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct
v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be
NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2508,12 +2511,17 @@ EXPORT_SYMBOL(v4l2_ctrl_cluster);
void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl
**controls,
u8 manual_val, bool set_volatile)
{
- struct v4l2_ctrl *master = controls[0];
+ struct v4l2_ctrl *master;
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!controls[0])
+ return;
+
+ master = controls[0];
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,8 @@ struct v4l2_ctrl_config {
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and
just returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl
**controls);
@@ -868,6 +870,8 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct
v4l2_ctrl **controls);
* In addition, this function will set the %V4L2_CTRL_FLAG_UPDATE flag
* on the autofoo control and %V4L2_CTRL_FLAG_INACTIVE on the foo
control(s)
* if autofoo is in auto mode.
+ *
+ * If controls[0] is NULL, then this function does nothing and
just returns.
*/
void v4l2_ctrl_auto_cluster(unsigned int ncontrols,
struct v4l2_ctrl **controls,
[-- Attachment #2: 0001-media-v4l2-ctrls-do-nothing-if-controls-0-is-NULL-in.patch --]
[-- Type: text/x-patch, Size: 4009 bytes --]
From: Rohinthan <rokinthanp03@gmail.com>
Subject: [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
Date: Fri, 11 Sep 2026 18:55:00 +0530
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
v2 -> v3:
- Fix the issue in the V4L2 core (v4l2-ctrls-core.c) instead of hackrf,
as suggested by Hans Verkuil.
- Return early if controls[0] == NULL in both v4l2_ctrl_cluster() and
v4l2_ctrl_auto_cluster().
- Update function documentation in include/media/v4l2-ctrls.h.
- Revert hackrf driver changes.
v1 -> v2:
- Corrected commit hash in Fixes tag.
drivers/media/v4l2-core/v4l2-ctrls-core.c | 16 ++++++++++++----
include/media/v4l2-ctrls.h | 4 ++++
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-core/v4l2-ctrls-core.c
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2490,7 +2490,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2508,12 +2511,17 @@ EXPORT_SYMBOL(v4l2_ctrl_cluster);
void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl **controls,
u8 manual_val, bool set_volatile)
{
- struct v4l2_ctrl *master = controls[0];
+ struct v4l2_ctrl *master;
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!controls[0])
+ return;
+
+ master = controls[0];
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,8 @@ struct v4l2_ctrl_config {
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and just returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
@@ -868,6 +870,8 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl **controls);
* In addition, this function will set the %V4L2_CTRL_FLAG_UPDATE flag
* on the autofoo control and %V4L2_CTRL_FLAG_INACTIVE on the foo control(s)
* if autofoo is in auto mode.
+ *
+ * If controls[0] is NULL, then this function does nothing and just returns.
*/
void v4l2_ctrl_auto_cluster(unsigned int ncontrols,
struct v4l2_ctrl **controls,
--
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions
@ 2026-09-11 13:33 Rokinthan p
0 siblings, 0 replies; 6+ messages in thread
From: Rokinthan p @ 2026-09-11 13:33 UTC (permalink / raw)
To: Hans Verkuil
Cc: Mauro Carvalho Chehab, linux-kernel, syzbot+9f7405999979761b6cfc
The V4L2 control framework is designed to allow drivers to instantiate
controls and clusters without checking for errors after each call,
checking hdl->error only once at the end.
However, if allocating the master control (controls[0]) fails, e.g. due to
memory allocation failure, v4l2_ctrl_cluster() triggers a WARNING:
ncontrols == 0 || controls[0] == NULL
WARNING: drivers/media/v4l2-core/v4l2-ctrls-core.c:2525 at
v4l2_ctrl_cluster
Additionally, v4l2_ctrl_auto_cluster() attempts to dereference
master->minimum without checking if controls[0] is NULL, leading to a
NULL pointer dereference when master control creation fails.
Update both v4l2_ctrl_cluster() and v4l2_ctrl_auto_cluster() to silently
return if controls[0] is NULL, preserving the design that control
creation errors are caught at the end when the driver checks hdl->error.
Also update function documentation in include/media/v4l2-ctrls.h.
Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files")
Reported-by: syzbot+cf896de36144391bcde1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf896de36144391bcde1
Suggested-by: Hans Verkuil <hverkuil@kernel.org>
Signed-off-by: Rohinthan <rokinthanp03@gmail.com>
---
v2 -> v3:
- Fix the issue in the V4L2 core (v4l2-ctrls-core.c) instead of hackrf,
as suggested by Hans Verkuil.
- Return early if controls[0] == NULL in both v4l2_ctrl_cluster() and
v4l2_ctrl_auto_cluster().
- Update function documentation in include/media/v4l2-ctrls.h.
- Revert hackrf driver changes.
v1 -> v2:
- Corrected commit hash in Fixes tag.
drivers/media/v4l2-core/v4l2-ctrls-core.c | 16 ++++++++++++----
include/media/v4l2-ctrls.h | 4 ++++
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-ctrls-core.c b/drivers/media/v4l2-
core/v4l2-ctrls-core.c
--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
@@ -2490,7 +2490,10 @@ void v4l2_ctrl_cluster(unsigned ncontrols, struct
v4l2_ctrl **controls)
int i;
/* The first control is the master control and it must not be
NULL */
- if (WARN_ON(ncontrols == 0 || controls[0] == NULL))
+ if (WARN_ON(ncontrols == 0))
+ return;
+
+ if (!controls[0])
return;
for (i = 0; i < ncontrols; i++) {
@@ -2508,12 +2511,17 @@ EXPORT_SYMBOL(v4l2_ctrl_cluster);
void v4l2_ctrl_auto_cluster(unsigned ncontrols, struct v4l2_ctrl
**controls,
u8 manual_val, bool set_volatile)
{
- struct v4l2_ctrl *master = controls[0];
+ struct v4l2_ctrl *master;
u32 flag = 0;
int i;
+ if (WARN_ON(ncontrols <= 1))
+ return;
+
+ if (!controls[0])
+ return;
+
+ master = controls[0];
v4l2_ctrl_cluster(ncontrols, controls);
- WARN_ON(ncontrols <= 1);
WARN_ON(manual_val < master->minimum || manual_val > master->maximum);
WARN_ON(set_volatile && !has_op(master, g_volatile_ctrl));
master->is_auto = true;
diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
--- a/include/media/v4l2-ctrls.h
+++ b/include/media/v4l2-ctrls.h
@@ -834,6 +834,8 @@ struct v4l2_ctrl_config {
*
* @ncontrols: The number of controls in this cluster.
* @controls: The cluster control array of size @ncontrols.
+ *
+ * If controls[0] is NULL, then this function does nothing and
just returns.
*/
void v4l2_ctrl_cluster(unsigned int ncontrols, struct v4l2_ctrl
**controls);
@@ -868,6 +870,8 @@ void v4l2_ctrl_cluster(unsigned int ncontrols, struct
v4l2_ctrl **controls);
* In addition, this function will set the %V4L2_CTRL_FLAG_UPDATE flag
* on the autofoo control and %V4L2_CTRL_FLAG_INACTIVE on the foo
control(s)
* if autofoo is in auto mode.
+ *
+ * If controls[0] is NULL, then this function does nothing and
just returns.
*/
void v4l2_ctrl_auto_cluster(unsigned int ncontrols,
struct v4l2_ctrl **controls,
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-23 7:21 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-17 3:37 [PATCH v3] media: v4l2-ctrls: do nothing if controls[0] == NULL in cluster functions Rokinthan p
2026-09-22 14:51 ` Hans Verkuil
2026-09-23 1:01 ` Rohinthan P
2026-09-23 7:21 ` Hans Verkuil
-- strict thread matches above, loose matches on Subject: below --
2026-09-17 3:42 Rokinthan p
2026-09-11 13:33 Rokinthan p
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®