This is a note to let you know that I've just added the patch titled
media: v4l: subdev: Make link validation safer
to the 6.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-v4l-subdev-make-link-validation-safer.patch
and it can be found in the queue-6.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit fce990f2650b36d3c231da3e959e7e36195e4ed4
Author: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
Date: Fri Feb 24 16:00:46 2023 +0100
media: v4l: subdev: Make link validation safer
[ Upstream commit 55f1ecb1199000932cf82e357841cc7498ac904f ]
Link validation currently accesses invalid pointers if the link passed to
it is not between two sub-devices. This is of course a driver bug.
Ignore the error but print a warning message, as this is how it used to
work previously.
Fixes: a6b995ed03ff ("media: subdev: use streams in v4l2_subdev_link_validate()")
Reported-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
Tested-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@xxxxxxxxxxxxxxxx>
Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
index b10045c02f434..9a0c23267626d 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -1236,6 +1236,16 @@ int v4l2_subdev_link_validate(struct media_link *link)
struct v4l2_subdev_state *source_state, *sink_state;
int ret;
+ if (!is_media_entity_v4l2_subdev(link->sink->entity) ||
+ !is_media_entity_v4l2_subdev(link->source->entity)) {
+ pr_warn_once("%s of link '%s':%u->'%s':%u is not a V4L2 sub-device, driver bug!\n",
+ !is_media_entity_v4l2_subdev(link->sink->entity) ?
+ "sink" : "source",
+ link->source->entity->name, link->source->index,
+ link->sink->entity->name, link->sink->index);
+ return 0;
+ }
+
sink_sd = media_entity_to_v4l2_subdev(link->sink->entity);
source_sd = media_entity_to_v4l2_subdev(link->source->entity);
