On Wed, 13 Jan 2021 at 06:08, Tomi Valkeinen
<tomi.valkeinen@xxxxxxxxxxxxxxxx> wrote:
>
> On 13/01/2021 11:00, Tomi Valkeinen wrote:
> > The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be
> > of size cal_v4l2_async_subdev, otherwise access to
> > cal_v4l2_async_subdev->phy will go to unallocated memory.
> >
> > Fixes: 8fcb7576ad19 ("media: ti-vpe: cal: Allow multiple contexts per subdev notifier")
> > Signed-off-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
>
> Ah, I forgot to add:
>
> Cc: stable@xxxxxxxxxxxxxxx # 5.9+
>
Nice catch. I missed users of v4l2_async_notifier_add_fwnode_subdev
in my recent cleanup series.
Reviewed-by: Ezequiel Garcia <ezequiel@xxxxxxxxxxxxx>
Thanks,
Ezequiel
> > ---
> > drivers/media/platform/ti-vpe/cal.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
> > index 59a0266b1f39..2eef245c31a1 100644
> > --- a/drivers/media/platform/ti-vpe/cal.c
> > +++ b/drivers/media/platform/ti-vpe/cal.c
> > @@ -406,7 +406,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
> > */
> >
> > struct cal_v4l2_async_subdev {
> > - struct v4l2_async_subdev asd;
> > + struct v4l2_async_subdev asd; /* Must be first */
> > struct cal_camerarx *phy;
> > };
> >
> > @@ -472,7 +472,7 @@ static int cal_async_notifier_register(struct cal_dev *cal)
> > fwnode = of_fwnode_handle(phy->sensor_node);
> > asd = v4l2_async_notifier_add_fwnode_subdev(&cal->notifier,
> > fwnode,
> > - sizeof(*asd));
> > + sizeof(*casd));
> > if (IS_ERR(asd)) {
> > phy_err(phy, "Failed to add subdev to notifier\n");
> > ret = PTR_ERR(asd);
> >
