* [PATCH v2] media: uvcvideo: Add sanity check to uvc_mapping_get_menu_value()
@ 2026-10-16 8:31 Dan Carpenter
2026-10-16 9:20 ` Ricardo Ribalda
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2026-10-16 8:31 UTC (permalink / raw)
To: Laurent Pinchart, Ricardo Ribalda
Cc: Hans de Goede, Mauro Carvalho Chehab, linux-media, linux-kernel,
kernel-janitors
Smatch warned that "idx" could be too large, leading to an out of bounds
read. When we reviewed the callers it was a false positive. However,
add a sanity check here anyway, just for future proofing and being
consistent with the rest of the code.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
v2: It's not a real bug but Ricardo asked me to add the sanity check
anyway. Use BITS_PER_TYPE() instead of BITS_PER_LONG.
drivers/media/usb/uvc/uvc_ctrl.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index d2f722bc3459..249c68783474 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -538,7 +538,8 @@ static void uvc_mapping_set_s32(struct uvc_control_mapping *mapping,
static int uvc_mapping_get_menu_value(const struct uvc_control_mapping *mapping,
u32 idx)
{
- if (!test_bit(idx, &mapping->menu_mask))
+ if (idx >= BITS_PER_TYPE(mapping->menu_mask) ||
+ !test_bit(idx, &mapping->menu_mask))
return -EINVAL;
if (mapping->menu_mapping)
--
2.53.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH v2] media: uvcvideo: Add sanity check to uvc_mapping_get_menu_value()
2026-10-16 8:31 [PATCH v2] media: uvcvideo: Add sanity check to uvc_mapping_get_menu_value() Dan Carpenter
@ 2026-10-16 9:20 ` Ricardo Ribalda
0 siblings, 0 replies; 2+ messages in thread
From: Ricardo Ribalda @ 2026-10-16 9:20 UTC (permalink / raw)
To: Dan Carpenter
Cc: Laurent Pinchart, Hans de Goede, Mauro Carvalho Chehab,
linux-media, linux-kernel, kernel-janitors
Hi Dan
Thanks for v2.
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
On Fri, 16 Oct 2026 at 16:31, Dan Carpenter <error27@gmail.com> wrote:
>
> Smatch warned that "idx" could be too large, leading to an out of bounds
> read. When we reviewed the callers it was a false positive. However,
> add a sanity check here anyway, just for future proofing and being
> consistent with the rest of the code.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> v2: It's not a real bug but Ricardo asked me to add the sanity check
> anyway. Use BITS_PER_TYPE() instead of BITS_PER_LONG.
>
> drivers/media/usb/uvc/uvc_ctrl.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> index d2f722bc3459..249c68783474 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -538,7 +538,8 @@ static void uvc_mapping_set_s32(struct uvc_control_mapping *mapping,
> static int uvc_mapping_get_menu_value(const struct uvc_control_mapping *mapping,
> u32 idx)
> {
> - if (!test_bit(idx, &mapping->menu_mask))
> + if (idx >= BITS_PER_TYPE(mapping->menu_mask) ||
> + !test_bit(idx, &mapping->menu_mask))
> return -EINVAL;
>
> if (mapping->menu_mapping)
> --
> 2.53.0
>
--
Ricardo Ribalda
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-16 9:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-16 8:31 [PATCH v2] media: uvcvideo: Add sanity check to uvc_mapping_get_menu_value() Dan Carpenter
2026-10-16 9:20 ` Ricardo Ribalda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®