linux-kernel - [PATCH] media: stm32: dcmipp: correct error handling in, dcmipp_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2dea6faf-53f6-461a-809b-ec572357ad07@xs4all.nl>
Date: Wed, 3 Jul 2024 13:59:16 +0200
From: Hans Verkuil <hverkuil-cisco@...all.nl>
To: Linux Media Mailing List <linux-media@...r.kernel.org>
Cc: Maxime Coquelin <mcoquelin.stm32@...il.com>,
 Alexandre Torgue <alexandre.torgue@...s.st.com>,
 Sakari Ailus <sakari.ailus@...ux.intel.com>,
 Alain Volmat <alain.volmat@...s.st.com>,
 Hugues Fruchet <hugues.fruchet@...com>, Linux Stable
 <stable@...r.kernel.org>,
 "linux-stm32@...md-mailman.stormreply.com"
 <linux-stm32@...md-mailman.stormreply.com>,
 linux-arm-kernel@...ts.infradead.org,
 Linux Kernel <linux-kernel@...r.kernel.org>
Subject: [PATCH] media: stm32: dcmipp: correct error handling in,
 dcmipp_create_subdevs

From: Alain Volmat <alain.volmat@...s.st.com>

Correct error handling within the dcmipp_create_subdevs by properly
decrementing the i counter when releasing the subdevs.

Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver")
Cc: stable@...r.kernel.org
Signed-off-by: Alain Volmat <alain.volmat@...s.st.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@...all.nl>
[hverkuil: correct the indices: it's [i], not [i - 1].]
---
The original patch would cause a crash due to the incorrect indices in the
statement after the while. Since 'i' can now become 0, so i - 1 would be a
negative index access, which was obviously not the intention.

I reverted the patch once I noticed this (better to hang in an infinite
loop than to crash), but I want to get a proper fix in. Rather than
waiting for that, I decided to just take the original patch from Alain, with
just the indices fixed.
---
 drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
index 4acc3b90d03a..7f771ea49b78 100644
--- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
+++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
@@ -202,8 +202,8 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp)
 	return 0;

 err_init_entity:
-	while (i > 0)
-		dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]);
+	while (i-- > 0)
+		dcmipp->pipe_cfg->ents[i].release(dcmipp->entity[i]);
 	return ret;
 }

-- 
2.43.0