linux-kernel - Re: [PATCH v1 04/10] media: platform: mediatek: add isp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e6336feb9043f1cf35949fb0c93aa18fc05415cd.camel@mediatek.com>
Date: Mon, 4 Nov 2024 08:04:02 +0000
From: CK Hu (胡俊光) <ck.hu@...iatek.com>
To: "sumit.semwal@...aro.org" <sumit.semwal@...aro.org>,
	"christian.koenig@....com" <christian.koenig@....com>, "mchehab@...nel.org"
	<mchehab@...nel.org>, "conor+dt@...nel.org" <conor+dt@...nel.org>,
	"robh@...nel.org" <robh@...nel.org>, "matthias.bgg@...il.com"
	<matthias.bgg@...il.com>, "krzk+dt@...nel.org" <krzk+dt@...nel.org>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
	Shu-hsiang Yang (楊舒翔)
	<Shu-hsiang.Yang@...iatek.com>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
	"yunkec@...omium.org" <yunkec@...omium.org>, "linaro-mm-sig@...ts.linaro.org"
	<linaro-mm-sig@...ts.linaro.org>, "linux-media@...r.kernel.org"
	<linux-media@...r.kernel.org>, "devicetree@...r.kernel.org"
	<devicetree@...r.kernel.org>, Yaya Chang (張雅清)
	<Yaya.Chang@...iatek.com>, Project_Global_Chrome_Upstream_Group
	<Project_Global_Chrome_Upstream_Group@...iatek.com>,
	"dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
	Teddy Chen (陳乾元) <Teddy.Chen@...iatek.com>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "hidenorik@...omium.org"
	<hidenorik@...omium.org>, Shun-Yi Wang (王順億)
	<Shun-Yi.Wang@...iatek.com>
Subject: Re: [PATCH v1 04/10] media: platform: mediatek: add isp_7x cam-raw
 unit

Hi, Shu-hsiang:

On Wed, 2024-10-09 at 19:15 +0800, Shu-hsiang Yang wrote:
> Introduces the ISP pipeline driver for the MediaTek ISP raw and yuv
> modules. Key functionalities include data processing, V4L2 integration,
> resource management, debug support, and various control operations.
> Additionally, IRQ handling, platform device management, and MediaTek
> ISP DMA format support are also included.
> 
> Signed-off-by: Shu-hsiang Yang <Shu-hsiang.Yang@...iatek.com>
> ---

[snip]

> +static bool mtk_raw_fmt_get_res(struct v4l2_subdev *sd,
> +				struct v4l2_subdev_format *fmt,
> +				struct mtk_cam_resource *res)
> +{
> +	void *user_ptr;
> +	u64 addr;
> +
> +	addr = ((u64)fmt->reserved[1] << 32) | fmt->reserved[2];

The callstack to this function is:

subdev_do_ioctl() -> mtk_raw_set_fmt() -> mtk_raw_try_pad_fmt() -> mtk_raw_set_src_pad_fmt() -> mtk_raw_fmt_get_res()

In subdev_do_ioctl() [1], fmt->reserved[] would be cleared to zero.
I don't know why you could get a non-zero addr value?

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/media/v4l2-core/v4l2-subdev.c?h=v6.12-rc6#n753

Regards,
CK

> +	user_ptr = (void *)addr;
> +	if (!user_ptr) {
> +		dev_info(sd->v4l2_dev->dev, "%s: mtk_cam_resource is null\n",
> +			 __func__);
> +		return false;
> +	}
> +
> +	if (copy_from_user(res, (void __user *)user_ptr, sizeof(*res))) {
> +		dev_info(sd->v4l2_dev->dev,
> +			 "%s: copy_from_user failedm user_ptr:%p\n",
> +			 __func__, user_ptr);
> +		return false;
> +	}
> +
> +	dev_dbg(sd->v4l2_dev->dev,
> +		"%s:sensor:%d/%d/%lld/%d/%d, raw:%lld/%d/%d/%d/%d/%d/%d/%d/%lld\n",
> +		__func__,
> +		res->sensor_res.hblank, res->sensor_res.vblank,
> +		res->sensor_res.pixel_rate, res->sensor_res.interval.denominator,
> +		res->sensor_res.interval.numerator,
> +		res->raw_res.feature, res->raw_res.bin, res->raw_res.path_sel,
> +		res->raw_res.raw_max, res->raw_res.raw_min, res->raw_res.raw_used,
> +		res->raw_res.strategy, res->raw_res.pixel_mode,
> +		res->raw_res.throughput);
> +
> +	return res;
> +}
> +