| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20241214-b4-linux-next-revert-link-freq-v1-1-5e970d05dfcd@linaro.org>
Date: Sat, 14 Dec 2024 22:52:07 +0000
From: Bryan O'Donoghue <bryan.odonoghue@...aro.org>
To: Robert Foss <rfoss@...nel.org>, Todor Tomov <todor.too@...il.com>,
Mauro Carvalho Chehab <mchehab@...nel.org>,
Hans Verkuil <hverkuil@...all.nl>,
Suresh Vankadara <quic_svankada@...cinc.com>,
Vikram Sharma <quic_vikramsa@...cinc.com>,
Trishansh Bhardwaj <quic_tbhardwa@...cinc.com>
Cc: linux-media@...r.kernel.org, linux-arm-msm@...r.kernel.org,
linux-kernel@...r.kernel.org, Bryan O'Donoghue <bryan.odonoghue@...aro.org>
Subject: [PATCH] Revert "media: qcom: camss: Restructure
camss_link_entities"
This reverts commit cc1ecabe67d92a2da0b0402f715598e8dbdc3b9e.
This commit has a basic flaw in that it relies on camss->res->csid_num as a
control to index the array camss->vfe[i].
Testing on a platform where csid_num > vfe_num showed this bug up.
camss->vfe should only be indexed by camss->res->vfe_num. Since this commit
is meant to make the code be more readable reverting will simply restore
the previous correct bounds checking.
We can make another pass at making camss_link_entities look prettier but,
for now we should zap the bug introduced.
Fixes: cc1ecabe67d9 ("media: qcom: camss: Restructure camss_link_entities")
---
Testing this commit out as I was adding in more CSID devices to my working
x1e tree I noticed a NULL pointer dereference in camss_link_entities.
Investigating I discovered the following indexing error:
> + for (i = 0; i < camss->res->csid_num; i++) {
> + if (camss->ispif)
> + line_num = camss->ispif->line_num;
> + else
> + line_num = camss->vfe[i].res->line_num;
This statement is incorrect, you are indexing vfe[] with a control derived
from csid_num.
Below is the statement removed.
> - for (i = 0; i < camss->res->csid_num; i++)
> - for (k = 0; k < camss->res->vfe_num; k++)
> - for (j = 0; j < camss->vfe[k].res->line_num; j++) {
As soon as csid_num > ARRAY_SIZE(vfe) the code breaks.
The commit is in linux-next but not yet in linux-stable so I'm not quite
sure what to do with a Fixes: tag nothing I think.
In any case we should revert this one before it hits stable.
Link: https://lore.kernel.org/linux-arm-msm/1a570c17-c501-4a29-a4f7-020f41563f3d@linaro.org
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@...aro.org>
---
drivers/media/platform/qcom/camss/camss.c | 155 ++++++++++--------------------
1 file changed, 52 insertions(+), 103 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index 004a74f6b2f6ce7eef15765ad1eadc14a08a3908..a85e9df0f301a933d7e47e07b9fec535819aeb14 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2298,6 +2298,7 @@ static int camss_init_subdevices(struct camss *camss)
}
/*
+ * camss_link_entities - Register subdev nodes and create links
* camss_link_err - print error in case link creation fails
* @src_name: name for source of the link
* @sink_name: name for sink of the link
@@ -2315,64 +2316,14 @@ inline void camss_link_err(struct camss *camss,
}
/*
- * camss_link_entities_csid - Register subdev nodes and create links
- * @camss: CAMSS device
- *
- * Return 0 on success or a negative error code on failure
- */
-static int camss_link_entities_csid(struct camss *camss)
-{
- struct media_entity *src_entity;
- struct media_entity *sink_entity;
- int ret, line_num;
- u16 sink_pad;
- u16 src_pad;
- int i, j;
-
- for (i = 0; i < camss->res->csid_num; i++) {
- if (camss->ispif)
- line_num = camss->ispif->line_num;
- else
- line_num = camss->vfe[i].res->line_num;
-
- src_entity = &camss->csid[i].subdev.entity;
- for (j = 0; j < line_num; j++) {
- if (camss->ispif) {
- sink_entity = &camss->ispif->line[j].subdev.entity;
- src_pad = MSM_CSID_PAD_SRC;
- sink_pad = MSM_ISPIF_PAD_SINK;
- } else {
- sink_entity = &camss->vfe[i].line[j].subdev.entity;
- src_pad = MSM_CSID_PAD_FIRST_SRC + j;
- sink_pad = MSM_VFE_PAD_SINK;
- }
-
- ret = media_create_pad_link(src_entity,
- src_pad,
- sink_entity,
- sink_pad,
- 0);
- if (ret < 0) {
- camss_link_err(camss, src_entity->name,
- sink_entity->name,
- ret);
- return ret;
- }
- }
- }
-
- return 0;
-}
-
-/*
- * camss_link_entities_csiphy - Register subdev nodes and create links
+ * camss_link_entities - Register subdev nodes and create links
* @camss: CAMSS device
*
* Return 0 on success or a negative error code on failure
*/
-static int camss_link_entities_csiphy(struct camss *camss)
+static int camss_link_entities(struct camss *camss)
{
- int i, j;
+ int i, j, k;
int ret;
for (i = 0; i < camss->res->csiphy_num; i++) {
@@ -2392,68 +2343,66 @@ static int camss_link_entities_csiphy(struct camss *camss)
}
}
- return 0;
-}
-
-/*
- * camss_link_entities_ispif - Register subdev nodes and create links
- * @camss: CAMSS device
- *
- * Return 0 on success or a negative error code on failure
- */
-static int camss_link_entities_ispif(struct camss *camss)
-{
- int i, j, k;
- int ret;
-
- for (i = 0; i < camss->ispif->line_num; i++) {
- for (k = 0; k < camss->res->vfe_num; k++) {
- for (j = 0; j < camss->vfe[k].res->line_num; j++) {
- struct v4l2_subdev *ispif = &camss->ispif->line[i].subdev;
- struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
-
- ret = media_create_pad_link(&ispif->entity,
- MSM_ISPIF_PAD_SRC,
- &vfe->entity,
- MSM_VFE_PAD_SINK,
+ if (camss->ispif) {
+ for (i = 0; i < camss->res->csid_num; i++) {
+ for (j = 0; j < camss->ispif->line_num; j++) {
+ ret = media_create_pad_link(&camss->csid[i].subdev.entity,
+ MSM_CSID_PAD_SRC,
+ &camss->ispif->line[j].subdev.entity,
+ MSM_ISPIF_PAD_SINK,
0);
if (ret < 0) {
- camss_link_err(camss, ispif->entity.name,
- vfe->entity.name,
+ camss_link_err(camss,
+ camss->csid[i].subdev.entity.name,
+ camss->ispif->line[j].subdev.entity.name,
ret);
return ret;
}
}
}
+
+ for (i = 0; i < camss->ispif->line_num; i++)
+ for (k = 0; k < camss->res->vfe_num; k++)
+ for (j = 0; j < camss->vfe[k].res->line_num; j++) {
+ struct v4l2_subdev *ispif = &camss->ispif->line[i].subdev;
+ struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
+
+ ret = media_create_pad_link(&ispif->entity,
+ MSM_ISPIF_PAD_SRC,
+ &vfe->entity,
+ MSM_VFE_PAD_SINK,
+ 0);
+ if (ret < 0) {
+ camss_link_err(camss, ispif->entity.name,
+ vfe->entity.name,
+ ret);
+ return ret;
+ }
+ }
+ } else {
+ for (i = 0; i < camss->res->csid_num; i++)
+ for (k = 0; k < camss->res->vfe_num; k++)
+ for (j = 0; j < camss->vfe[k].res->line_num; j++) {
+ struct v4l2_subdev *csid = &camss->csid[i].subdev;
+ struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
+
+ ret = media_create_pad_link(&csid->entity,
+ MSM_CSID_PAD_FIRST_SRC + j,
+ &vfe->entity,
+ MSM_VFE_PAD_SINK,
+ 0);
+ if (ret < 0) {
+ camss_link_err(camss, csid->entity.name,
+ vfe->entity.name,
+ ret);
+ return ret;
+ }
+ }
}
return 0;
}
-/*
- * camss_link_entities - Register subdev nodes and create links
- * @camss: CAMSS device
- *
- * Return 0 on success or a negative error code on failure
- */
-static int camss_link_entities(struct camss *camss)
-{
- int ret;
-
- ret = camss_link_entities_csiphy(camss);
- if (ret < 0)
- return ret;
-
- ret = camss_link_entities_csid(camss);
- if (ret < 0)
- return ret;
-
- if (camss->ispif)
- ret = camss_link_entities_ispif(camss);
-
- return ret;
-}
-
/*
* camss_register_entities - Register subdev nodes and create links
* @camss: CAMSS device
---
base-commit: 4176cf5c5651c33769de83bb61b0287f4ec7719f
change-id: 20241214-b4-linux-next-revert-link-freq-74ab5f2f7302
Best regards,
--
Bryan O'Donoghue <bryan.odonoghue@...aro.org>
Powered by blists - more mailing lists