Re: [PATCH] media: ti-vpe: cal: fix write to unallocated memory

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 13/01/2021 11:00, Tomi Valkeinen wrote:
> The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be
> of size cal_v4l2_async_subdev, otherwise access to
> cal_v4l2_async_subdev->phy will go to unallocated memory.
> 
> Fixes: 8fcb7576ad19 ("media: ti-vpe: cal: Allow multiple contexts per subdev notifier")
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>

Ah, I forgot to add:

Cc: stable@xxxxxxxxxxxxxxx # 5.9+

> ---
>  drivers/media/platform/ti-vpe/cal.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
> index 59a0266b1f39..2eef245c31a1 100644
> --- a/drivers/media/platform/ti-vpe/cal.c
> +++ b/drivers/media/platform/ti-vpe/cal.c
> @@ -406,7 +406,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
>   */
>  
>  struct cal_v4l2_async_subdev {
> -	struct v4l2_async_subdev asd;
> +	struct v4l2_async_subdev asd; /* Must be first */
>  	struct cal_camerarx *phy;
>  };
>  
> @@ -472,7 +472,7 @@ static int cal_async_notifier_register(struct cal_dev *cal)
>  		fwnode = of_fwnode_handle(phy->sensor_node);
>  		asd = v4l2_async_notifier_add_fwnode_subdev(&cal->notifier,
>  							    fwnode,
> -							    sizeof(*asd));
> +							    sizeof(*casd));
>  		if (IS_ERR(asd)) {
>  			phy_err(phy, "Failed to add subdev to notifier\n");
>  			ret = PTR_ERR(asd);
> 




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux