On 24/06/2024 10:41, Alain Volmat wrote:
> Correct error handling within the dcmipp_create_subdevs by properly
> decrementing the i counter when releasing the subdeves.
>
> Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Alain Volmat <alain.volmat@xxxxxxxxxxx>
> ---
> drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
> index 4acc3b90d03a..4924ee36cfda 100644
> --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
> +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c
> @@ -202,7 +202,7 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp)
> return 0;
>
> err_init_entity:
> - while (i > 0)
> + while (i-- > 0)
> dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]);
> return ret;
> }
I accidentally merged this one, but this patch isn't right.
After this change the [i - 1] indices should be changed to [i].
If i == 1, then the while condition is true, but now i == 0 in the
actual statement, so you access out-of-bounds values.
I decided to revert it, since it is better to just get stuck in the
while loop, then to crash.
But a new patch is needed for this.
Regards,
Hans
