* [PATCH v2] media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
@ 2026-05-08 4:53 Martin Hecht
2026-05-08 6:25 ` Martin Hecht
0 siblings, 1 reply; 2+ messages in thread
From: Martin Hecht @ 2026-05-08 4:53 UTC (permalink / raw)
Cc: sakari.ailus, martin.hecht, michael.roeder, stable, Martin Hecht,
Tommaso Merciai, Mauro Carvalho Chehab, Hans Verkuil, linux-media,
linux-kernel
The current implementation of alvium_ctrl_init creates several controls
in function alvium_ctrl_init and uses the returned pointer without
check. That can cause write access over NULL-pointer for several
controls.
The reworked code checks the pointers before adding flags and also it
creates controls for V4L2_CID_BLUE_BALANCE and V4L2_CID_RED_BALANCE only
if supported by the particular camera model.
Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Hecht <mhecht73@gmail.com>
---
drivers/media/i2c/alvium-csi2.c | 72 +++++++++++++++++++--------------
1 file changed, 42 insertions(+), 30 deletions(-)
diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
index b62b45a4f2fc..43535ba7a264 100644
--- a/drivers/media/i2c/alvium-csi2.c
+++ b/drivers/media/i2c/alvium-csi2.c
@@ -2100,34 +2100,41 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
V4L2_CID_PIXEL_RATE, 0,
ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1,
ALVIUM_DEFAULT_PIXEL_RATE_MHZ);
- ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ if (ctrls->pixel_rate)
+ ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
/* Link freq is fixed */
ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops,
V4L2_CID_LINK_FREQ,
0, 0, &alvium->link_freq);
- ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
-
- /* Auto/manual white balance */
+ if (ctrls->link_freq)
+ ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+
+ /* manual white balance */
+ if (alvium->avail_ft.whiteb) {
+ ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
+ V4L2_CID_BLUE_BALANCE,
+ alvium->min_bbalance,
+ alvium->max_bbalance,
+ alvium->inc_bbalance,
+ alvium->dft_bbalance);
+
+ ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
+ V4L2_CID_RED_BALANCE,
+ alvium->min_rbalance,
+ alvium->max_rbalance,
+ alvium->inc_rbalance,
+ alvium->dft_rbalance);
+ }
+
+ /* Auto white balance */
if (alvium->avail_ft.auto_whiteb) {
ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops,
V4L2_CID_AUTO_WHITE_BALANCE,
0, 1, 1, 1);
- v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
- }
-
- ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
- V4L2_CID_BLUE_BALANCE,
- alvium->min_bbalance,
- alvium->max_bbalance,
- alvium->inc_bbalance,
- alvium->dft_bbalance);
- ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
- V4L2_CID_RED_BALANCE,
- alvium->min_rbalance,
- alvium->max_rbalance,
- alvium->inc_rbalance,
- alvium->dft_rbalance);
+ if (ctrls->auto_wb)
+ v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
+ }
/* Auto/manual exposure */
if (alvium->avail_ft.auto_exp) {
@@ -2136,7 +2143,9 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
V4L2_CID_EXPOSURE_AUTO,
V4L2_EXPOSURE_MANUAL, 0,
V4L2_EXPOSURE_AUTO);
- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
+ if (ctrls->auto_exp)
+ v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp,
+ V4L2_EXPOSURE_MANUAL, true);
}
ctrls->exposure = v4l2_ctrl_new_std(hdl, ops,
@@ -2145,15 +2154,8 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
alvium->max_exp,
alvium->inc_exp,
alvium->dft_exp);
- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
-
- /* Auto/manual gain */
- if (alvium->avail_ft.auto_gain) {
- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
- V4L2_CID_AUTOGAIN,
- 0, 1, 1, 1);
- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
- }
+ if (ctrls->exposure)
+ ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
if (alvium->avail_ft.gain) {
ctrls->gain = v4l2_ctrl_new_std(hdl, ops,
@@ -2162,7 +2164,17 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
alvium->max_gain,
alvium->inc_gain,
alvium->dft_gain);
- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+ if (ctrls->gain)
+ ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
+ }
+
+ /* Auto/manual gain */
+ if (alvium->avail_ft.auto_gain) {
+ ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
+ V4L2_CID_AUTOGAIN,
+ 0, 1, 1, 1);
+ if (ctrls->auto_gain)
+ v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
}
if (alvium->avail_ft.sat)
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] media: i2c: alvium: fix critical pointer access in alvium_ctrl_init
2026-05-08 4:53 [PATCH v2] media: i2c: alvium: fix critical pointer access in alvium_ctrl_init Martin Hecht
@ 2026-05-08 6:25 ` Martin Hecht
0 siblings, 0 replies; 2+ messages in thread
From: Martin Hecht @ 2026-05-08 6:25 UTC (permalink / raw)
Cc: sakari.ailus, martin.hecht, michael.roeder, stable,
Tommaso Merciai, Mauro Carvalho Chehab, Hans Verkuil, linux-media,
linux-kernel
Hi all,
please ignore that misleading patch. I send the wrong file. I set the
status on patchwork on obsolete. I'm preparing v3 after cleanup.
Kindly regards,
Martin
On 5/8/26 06:53, Martin Hecht wrote:
> The current implementation of alvium_ctrl_init creates several controls
> in function alvium_ctrl_init and uses the returned pointer without
> check. That can cause write access over NULL-pointer for several
> controls.
> The reworked code checks the pointers before adding flags and also it
> creates controls for V4L2_CID_BLUE_BALANCE and V4L2_CID_RED_BALANCE only
> if supported by the particular camera model.
>
> Fixes: 0a7af872915e ("media: i2c: Add support for alvium camera")
> Cc: stable@vger.kernel.org
> Signed-off-by: Martin Hecht <mhecht73@gmail.com>
> ---
> drivers/media/i2c/alvium-csi2.c | 72 +++++++++++++++++++--------------
> 1 file changed, 42 insertions(+), 30 deletions(-)
>
> diff --git a/drivers/media/i2c/alvium-csi2.c b/drivers/media/i2c/alvium-csi2.c
> index b62b45a4f2fc..43535ba7a264 100644
> --- a/drivers/media/i2c/alvium-csi2.c
> +++ b/drivers/media/i2c/alvium-csi2.c
> @@ -2100,34 +2100,41 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
> V4L2_CID_PIXEL_RATE, 0,
> ALVIUM_DEFAULT_PIXEL_RATE_MHZ, 1,
> ALVIUM_DEFAULT_PIXEL_RATE_MHZ);
> - ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
> + if (ctrls->pixel_rate)
> + ctrls->pixel_rate->flags |= V4L2_CTRL_FLAG_READ_ONLY;
>
> /* Link freq is fixed */
> ctrls->link_freq = v4l2_ctrl_new_int_menu(hdl, ops,
> V4L2_CID_LINK_FREQ,
> 0, 0, &alvium->link_freq);
> - ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
> -
> - /* Auto/manual white balance */
> + if (ctrls->link_freq)
> + ctrls->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
> +
> + /* manual white balance */
> + if (alvium->avail_ft.whiteb) {
> + ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
> + V4L2_CID_BLUE_BALANCE,
> + alvium->min_bbalance,
> + alvium->max_bbalance,
> + alvium->inc_bbalance,
> + alvium->dft_bbalance);
> +
> + ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
> + V4L2_CID_RED_BALANCE,
> + alvium->min_rbalance,
> + alvium->max_rbalance,
> + alvium->inc_rbalance,
> + alvium->dft_rbalance);
> + }
> +
> + /* Auto white balance */
> if (alvium->avail_ft.auto_whiteb) {
> ctrls->auto_wb = v4l2_ctrl_new_std(hdl, ops,
> V4L2_CID_AUTO_WHITE_BALANCE,
> 0, 1, 1, 1);
> - v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
> - }
> -
> - ctrls->blue_balance = v4l2_ctrl_new_std(hdl, ops,
> - V4L2_CID_BLUE_BALANCE,
> - alvium->min_bbalance,
> - alvium->max_bbalance,
> - alvium->inc_bbalance,
> - alvium->dft_bbalance);
> - ctrls->red_balance = v4l2_ctrl_new_std(hdl, ops,
> - V4L2_CID_RED_BALANCE,
> - alvium->min_rbalance,
> - alvium->max_rbalance,
> - alvium->inc_rbalance,
> - alvium->dft_rbalance);
> + if (ctrls->auto_wb)
> + v4l2_ctrl_auto_cluster(3, &ctrls->auto_wb, 0, false);
> + }
>
> /* Auto/manual exposure */
> if (alvium->avail_ft.auto_exp) {
> @@ -2136,7 +2143,9 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
> V4L2_CID_EXPOSURE_AUTO,
> V4L2_EXPOSURE_MANUAL, 0,
> V4L2_EXPOSURE_AUTO);
> - v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
> + if (ctrls->auto_exp)
> + v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp,
> + V4L2_EXPOSURE_MANUAL, true);
> }
>
> ctrls->exposure = v4l2_ctrl_new_std(hdl, ops,
> @@ -2145,15 +2154,8 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
> alvium->max_exp,
> alvium->inc_exp,
> alvium->dft_exp);
> - ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
> -
> - /* Auto/manual gain */
> - if (alvium->avail_ft.auto_gain) {
> - ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
> - V4L2_CID_AUTOGAIN,
> - 0, 1, 1, 1);
> - v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
> - }
> + if (ctrls->exposure)
> + ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
>
> if (alvium->avail_ft.gain) {
> ctrls->gain = v4l2_ctrl_new_std(hdl, ops,
> @@ -2162,7 +2164,17 @@ static int alvium_ctrl_init(struct alvium_dev *alvium)
> alvium->max_gain,
> alvium->inc_gain,
> alvium->dft_gain);
> - ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
> + if (ctrls->gain)
> + ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
> + }
> +
> + /* Auto/manual gain */
> + if (alvium->avail_ft.auto_gain) {
> + ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops,
> + V4L2_CID_AUTOGAIN,
> + 0, 1, 1, 1);
> + if (ctrls->auto_gain)
> + v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
> }
>
> if (alvium->avail_ft.sat)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-08 6:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-08 4:53 [PATCH v2] media: i2c: alvium: fix critical pointer access in alvium_ctrl_init Martin Hecht
2026-05-08 6:25 ` Martin Hecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox