Re: [PATCH v1] media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

[Sakari Ailus <sakari.ailus@linux.intel.com>]

Hi Martin,

On Thu, May 07, 2026 at 06:34:30PM +0200, Martin Hecht wrote:
> The current implementation of alvium_ctrl_init creates several controls
> in function alvium_ctrl_init and uses the returned pointer without
> check. That can cause write access over NULL-pointer for several
> controls.

No reason to have so short lines in the middle of a paragraph. But...

> The reworked code checks the pointers before adding flags and also it
> creates controls for V4L2_CID_BLUE_BALANCE and V4L2_CID_RED_BALANCE only
> if supported by the particular camera model.

can you put this into a separate patch? It's a different issue, albeit both
patches are dealing with controls.

> 
> Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
> Cc: stable@vger.kernel.org
> Signed-off-by: Martin Hecht <mhecht73@gmail.com>
> ---
>  drivers/media/i2c/alvium-csi2.c | 72 +++++++++++++++++++--------------
>  1 file changed, 42 insertions(+), 30 deletions(-)
> 
> diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
> index b62b45a4f2fc..947b32950efa 100644
> --- a/drivers/media/i2c/alvium-csi2.c
> +++ b/drivers/media/i2c/alvium-csi2.c
> @@ -2100,34 +2100,41 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
>  					      V4L2_CID_PIXEL_RATE, 0,
>  					      ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1,
>  					      ALVIUM_DEFAULT_PIXEL_RATE_MHZ);
> -	ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
> +	if (ctrls->pixel_rate)
> +		ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;

There are many controls that need flags and your next patch was going to
set the flags after checking the error. I'd therefore do that here, too.

The PIXEL_RATE controls's READ_ONLY flag is set by the framework, the
driver doesn't need to set it anymore. I'd just remove the line setting the
flag above.

>  
>  	/* Link freq is fixed */
>  	ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops,
>  						  V4L2_CID_LINK_FREQ,
>  						  0, 0, &alvium->link_freq);
> -	ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
> -
> -	/* Auto/manual white balance */
> +	if (ctrls->link_freq)
> +		ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
> +
> +	/* manual white balance */
> +	if (alvium->avail_ft.whiteb) {
> +		ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
> +							V4L2_CID_BLUE_BALANCE,
> +							alvium->min_bbalance,
> +							alvium->max_bbalance,
> +							alvium->inc_bbalance,
> +							alvium->dft_bbalance);
> +
> +		ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
> +						       V4L2_CID_RED_BALANCE,
> +						       alvium->min_rbalance,
> +						       alvium->max_rbalance,
> +						       alvium->inc_rbalance,
> +						       alvium->dft_rbalance);
> +	}
> +
> +	/* Auto white balance */
>  	if (alvium->avail_ft.auto_whiteb) {
>  		ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops,
>  						   V4L2_CID_AUTO_WHITE_BALANCE,
>  						   0, 1, 1, 1);
> -		v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
> -	}
> -
> -	ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
> -						V4L2_CID_BLUE_BALANCE,
> -						alvium->min_bbalance,
> -						alvium->max_bbalance,
> -						alvium->inc_bbalance,
> -						alvium->dft_bbalance);
> -	ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
> -					       V4L2_CID_RED_BALANCE,
> -					       alvium->min_rbalance,
> -					       alvium->max_rbalance,
> -					       alvium->inc_rbalance,
> -					       alvium->dft_rbalance);
> +		if (ctrls->auto_wb)
> +			v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
> +	}
>  
>  	/* Auto/manual exposure */
>  	if (alvium->avail_ft.auto_exp) {
> @@ -2136,7 +2143,9 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
>  					       V4L2_CID_EXPOSURE_AUTO,
>  					       V4L2_EXPOSURE_MANUAL, 0,
>  					       V4L2_EXPOSURE_AUTO);
> -		v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
> +		if (ctrls->auto_exp)
> +			v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp,
> +					       V4L2_EXPOSURE_MANUAL, true);
>  	}
>  
>  	ctrls->exposure = v4l2_ctrl_new_std(hdl, ops,
> @@ -2145,15 +2154,8 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
>  					    alvium->max_exp,
>  					    alvium->inc_exp,
>  					    alvium->dft_exp);
> -	ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
> -
> -	/* Auto/manual gain */
> -	if (alvium->avail_ft.auto_gain) {
> -		ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
> -						     V4L2_CID_AUTOGAIN,
> -						     0, 1, 1, 1);
> -		v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
> -	}
> +	if (ctrls->exposure)
> +		ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
>  
>  	if (alvium->avail_ft.gain) {
>  		ctrls->gain = v4l2_ctrl_new_std(hdl, ops,
> @@ -2162,7 +2164,17 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
>  						alvium->max_gain,
>  						alvium->inc_gain,
>  						alvium->dft_gain);
> -		ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
> +		if (ctrls->gain)
> +			ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
> +	}
> +
> +	/* Auto/manual gain */
> +	if (alvium->avail_ft.auto_gain) {
> +		ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
> +						     V4L2_CID_AUTOGAIN,
> +						     0, 1, 1, 1);
> +		if (ctrls->auto_gain)
> +			v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
>  	}
>  
>  	if (alvium->avail_ft.sat)

-- 
Kind regards,

Sakari Ailus