Re: [PATCH] media: ti-vpe: cal: fix write to unallocated memory

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 13 Jan 2021 at 06:08, Tomi Valkeinen
<tomi.valkeinen@xxxxxxxxxxxxxxxx> wrote:
>
> On 13/01/2021 11:00, Tomi Valkeinen wrote:
> > The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be
> > of size cal_v4l2_async_subdev, otherwise access to
> > cal_v4l2_async_subdev->phy will go to unallocated memory.
> >
> > Fixes: 8fcb7576ad19 ("media: ti-vpe: cal: Allow multiple contexts per subdev notifier")
> > Signed-off-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
>
> Ah, I forgot to add:
>
> Cc: stable@xxxxxxxxxxxxxxx # 5.9+
>

Nice catch. I missed users of v4l2_async_notifier_add_fwnode_subdev
in my recent cleanup series.

Reviewed-by: Ezequiel Garcia <ezequiel@xxxxxxxxxxxxx>

Thanks,
Ezequiel

> > ---
> >  drivers/media/platform/ti-vpe/cal.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
> > index 59a0266b1f39..2eef245c31a1 100644
> > --- a/drivers/media/platform/ti-vpe/cal.c
> > +++ b/drivers/media/platform/ti-vpe/cal.c
> > @@ -406,7 +406,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
> >   */
> >
> >  struct cal_v4l2_async_subdev {
> > -     struct v4l2_async_subdev asd;
> > +     struct v4l2_async_subdev asd; /* Must be first */
> >       struct cal_camerarx *phy;
> >  };
> >
> > @@ -472,7 +472,7 @@ static int cal_async_notifier_register(struct cal_dev *cal)
> >               fwnode = of_fwnode_handle(phy->sensor_node);
> >               asd = v4l2_async_notifier_add_fwnode_subdev(&cal->notifier,
> >                                                           fwnode,
> > -                                                         sizeof(*asd));
> > +                                                         sizeof(*casd));
> >               if (IS_ERR(asd)) {
> >                       phy_err(phy, "Failed to add subdev to notifier\n");
> >                       ret = PTR_ERR(asd);
> >



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux