[PATCH 1/2] rcar-vin: Verify pads on linkage

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Kieran Bingham <kieran.bingham+renesas@xxxxxxxxxxxxxxxx>

The current code determines the pad from the identifiers in the DTB.
This is accepted without bounds in the driver.

Invalid port/reg addresses defined in the DTB will cause a kernel panic
when dereferencing non-existing pads.

Protect the linkage with a check that the pad numbers are valid.

Signed-off-by: Kieran Bingham <kieran.bingham+renesas@xxxxxxxxxxxxxxxx>
---
 drivers/media/platform/rcar-vin/rcar-core.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
index 893018963847..48557628e76d 100644
--- a/drivers/media/platform/rcar-vin/rcar-core.c
+++ b/drivers/media/platform/rcar-vin/rcar-core.c
@@ -613,6 +613,18 @@ static int rvin_group_add_link(struct rvin_dev *vin,
 	struct media_pad *source_pad, *sink_pad;
 	int ret = 0;
 
+	if (source_idx >= source->num_pads) {
+		vin_err(vin, "Source pad idx %d is greater than pad count %d\n",
+			source_idx, source->num_pads);
+		return -EINVAL;
+	}
+
+	if (sink_idx >= sink->num_pads) {
+		vin_err(vin, "Sink pad idx %d is greater than pad count %d\n",
+			source_idx, source->num_pads);
+		return -EINVAL;
+	}
+
 	source_pad = &source->pads[source_idx];
 	sink_pad = &sink->pads[sink_idx];
 
-- 
2.7.4




[Index of Archives]     [Linux Samsung SOC]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]

  Powered by Linux