[RFC PATCH] Fix and invalid array indexing in isp_csi2_complexio_lanes_config

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Fix and invalid array indexing when refcfg->data[i].pos is equal to 0.
The code access an invalid location.

Signed-off-by: Michael Trimarchi <michael@xxxxxxxxxxxxxxxxxxxxxxx>
cc: akari Ailus <sakari.ailus@xxxxxxxxxxxxxxxxxxxxxxxxxx>
cc: Sergio Aguirre <saaguirre@xxxxxx>

---
diff --git a/drivers/media/video/isp/ispcsi2.c b/drivers/media/video/isp/ispcsi2.c
index fb0f44f..cc8fa39 100644
--- a/drivers/media/video/isp/ispcsi2.c
+++ b/drivers/media/video/isp/ispcsi2.c
@@ -85,8 +85,10 @@ int isp_csi2_complexio_lanes_config(struct isp_csi2_device *isp_csi2,
 			       " parameters for data lane #%d\n", i);
 			goto err_einval;
 		}
-		if (pos_occupied[reqcfg->data[i].pos - 1] &&
-		    reqcfg->data[i].pos > 0) {
+		if (!reqcfg->data[i].pos)
+			continue;
+
+		if (pos_occupied[reqcfg->data[i].pos - 1]) {
 			printk(KERN_ERR "Lane #%d already occupied\n",
 			       reqcfg->data[i].pos);
 			goto err_einval;

[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux