linux-kernel - Re: [PATCH] media: stm32: dcmipp: correct error handling in dcmipp_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8587b6cd-2d04-4a2e-b298-e57c792332f1@xs4all.nl>
Date: Thu, 27 Jun 2024 13:17:55 +0200
From: Hans Verkuil <hverkuil-cisco@...all.nl>
To: Alain Volmat <alain.volmat@...s.st.com>,
 Hugues Fruchet <hugues.fruchet@...s.st.com>,
 Mauro Carvalho Chehab <mchehab@...nel.org>,
 Maxime Coquelin <mcoquelin.stm32@...il.com>,
 Alexandre Torgue <alexandre.torgue@...s.st.com>,
 Sakari Ailus <sakari.ailus@...ux.intel.com>
Cc: stable@...r.kernel.org, linux-media@...r.kernel.org,
 linux-stm32@...md-mailman.stormreply.com,
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] media: stm32: dcmipp: correct error handling in
 dcmipp_create_subdevs

On 24/06/2024 10:41, Alain Volmat wrote:
> Correct error handling within the dcmipp_create_subdevs by properly
> decrementing the i counter when releasing the subdeves.
> 
> Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver")
> Cc: stable@...r.kernel.org
> Signed-off-by: Alain Volmat <alain.volmat@...s.st.com>
> ---
>  drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
> index 4acc3b90d03a..4924ee36cfda 100644
> --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
> +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
> @@ -202,7 +202,7 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp)
>  	return 0;
>  
>  err_init_entity:
> -	while (i > 0)
> +	while (i-- > 0)
>  		dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]);
>  	return ret;
>  }

I accidentally merged this one, but this patch isn't right.

After this change the [i - 1] indices should be changed to [i].
If i == 1, then the while condition is true, but now i == 0 in the
actual statement, so you access out-of-bounds values.

I decided to revert it, since it is better to just get stuck in the
while loop, then to crash.

But a new patch is needed for this.

Regards,

	Hans