Fix device removal loop bounds

[Shaoen-Lin]

When removing a device, the control device shifts the remaining vcam_devices entries left by reading vcam_devices[i + 1].

The current loop allows i to reach vcam_device_count - 1, so the last iteration reads vcam_devices[vcam_device_count], which is outside the valid range.

Stop the loop before i + 1 reaches vcam_device_count.

---

Summary by cubic

Fix off-by-one in the device removal shift loop by bounding it to i + 1 < vcam_device_count, preventing reads past the end of vcam_devices. This avoids out-of-bounds access and crashes when removing the last device.

^{Written for commit ce31656. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="control.c">

<violation number="1" location="control.c:122">
P0: TOCTOU race condition in device destruction: device pointer captured outside `vcam_devices_lock` while array mutation happens inside it. Concurrent `VCAM_IOCTL_DESTROY_DEVICE` calls on different indices can leave a dangling pointer in `vcam_devices` after one thread frees the device, causing UAF on later access.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P0: TOCTOU race condition in device destruction: device pointer captured outside vcam_devices_lock while array mutation happens inside it. Concurrent VCAM_IOCTL_DESTROY_DEVICE calls on different indices can leave a dangling pointer in vcam_devices after one thread frees the device, causing UAF on later access.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At control.c, line 122:

<comment>TOCTOU race condition in device destruction: device pointer captured outside `vcam_devices_lock` while array mutation happens inside it. Concurrent `VCAM_IOCTL_DESTROY_DEVICE` calls on different indices can leave a dangling pointer in `vcam_devices` after one thread frees the device, causing UAF on later access.</comment>

<file context>
@@ -119,7 +119,7 @@ static int control_iocontrol_destroy_device(struct vcam_device_spec *dev_spec)
 
     spin_lock_irqsave(&ctldev->vcam_devices_lock, flags);
-    for (i = dev_spec->idx; i < (ctldev->vcam_device_count); i++)
+    for (i = dev_spec->idx; i + 1 < (ctldev->vcam_device_count); i++)
         ctldev->vcam_devices[i] = ctldev->vcam_devices[i + 1];
     ctldev->vcam_devices[--ctldev->vcam_device_count] = NULL;
</file context>