diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2020-09-03 16:30:51 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2020-09-03 16:30:50 -0700 |
| commit | 902704b356fbfd8b6c19c04d0b3122dfbf3e78d8 (patch) | |
| tree | 9cd56ec615d037681ab62203fc2a4b067e24fb3e | |
| parent | 5948b13320d83080a008e21514bbe6e61d39871a (diff) | |
| parent | 750411ad0a0d230d83e9fd8301ea1ec509f39cae (diff) | |
Merge "media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors"
| -rw-r--r-- | drivers/media/usb/uvc/uvc_driver.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index ebd1b882556d..9cd0268b2767 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1411,6 +1411,11 @@ static int uvc_scan_chain_forward(struct uvc_video_chain *chain, break; if (forward == prev) continue; + if (forward->chain.next || forward->chain.prev) { + uvc_trace(UVC_TRACE_DESCR, "Found reference to " + "entity %d already in chain.\n", forward->id); + return -EINVAL; + } switch (UVC_ENTITY_TYPE(forward)) { case UVC_VC_EXTENSION_UNIT: @@ -1492,6 +1497,13 @@ static int uvc_scan_chain_backward(struct uvc_video_chain *chain, return -1; } + if (term->chain.next || term->chain.prev) { + uvc_trace(UVC_TRACE_DESCR, "Found reference to " + "entity %d already in chain.\n", + term->id); + return -EINVAL; + } + if (uvc_trace_param & UVC_TRACE_PROBE) printk(" %d", term->id); |