Re: [PATCH v2] media: uvcvideo: Add sanity check to uvc_mapping_get_menu_value()

[Ricardo Ribalda]

Hi Dan

Thanks for v2.

Reviewed-by: Ricardo Ribalda <ribalda@xxxxxxxxxxxx>

On Fri, 16 Oct 2026 at 16:31, Dan Carpenter <error27@xxxxxxxxx> wrote:
>
> Smatch warned that "idx" could be too large, leading to an out of bounds
> read.  When we reviewed the callers it was a false positive.  However,
> add a sanity check here anyway, just for future proofing and being
> consistent with the rest of the code.
>
> Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
> ---
> v2: It's not a real bug but Ricardo asked me to add the sanity check
> anyway.  Use BITS_PER_TYPE() instead of BITS_PER_LONG.
>
>  drivers/media/usb/uvc/uvc_ctrl.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> index d2f722bc3459..249c68783474 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -538,7 +538,8 @@ static void uvc_mapping_set_s32(struct uvc_control_mapping *mapping,
>  static int uvc_mapping_get_menu_value(const struct uvc_control_mapping *mapping,
>                                       u32 idx)
>  {
> -       if (!test_bit(idx, &mapping->menu_mask))
> +       if (idx >= BITS_PER_TYPE(mapping->menu_mask) ||
> +           !test_bit(idx, &mapping->menu_mask))
>                 return -EINVAL;
>
>         if (mapping->menu_mapping)
> --
> 2.53.0
>


-- 
Ricardo Ribalda