On Mon, Jan 23, 2023 at 01:51:22PM +0100, Hans de Goede wrote: > Check buffer index is in range inside atomisp_qbuf_wrapper() before > using it do index pipe->frame_request_config_id[]. ... > /* FIXME this abuse of buf->reserved2 comes from the original atomisp buffer handling */ Does the comment belong to this check? > + if (buf->index >= vdev->queue->num_buffers) > + return -EINVAL; > + > if (!atomisp_is_vf_pipe(pipe) && > (buf->reserved2 & ATOMISP_BUFFER_HAS_PER_FRAME_SETTING)) { > /* this buffer will have a per-frame parameter */ -- With Best Regards, Andy Shevchenko