[PATCH 5.12 172/384] atomisp: dont let it go past pipes array
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: 2021-05-10 12:17:35
Also in:
lkml
Subsystem:
intel mid (mobile internet device) platform, media input infrastructure (v4l/dvb), staging - atomisp driver, staging subsystem, the rest · Maintainers:
Andy Shevchenko, Mauro Carvalho Chehab, Hans de Goede, Greg Kroah-Hartman, Linus Torvalds
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> [ Upstream commit 1f6c45ac5fd70ab59136ab5babc7def269f3f509 ] In practice, IA_CSS_PIPE_ID_NUM should never be used when calling atomisp_q_video_buffers_to_css(), as the driver should discover the right pipe before calling it. Yet, if some pipe parsing issue happens, it could end using it. So, add a WARN_ON() to prevent such case. Reported-by: Dan Carpenter <redacted> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/staging/media/atomisp/pci/atomisp_fops.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c
index 453bb6913550..f1e6b2597853 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_fops.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c@@ -221,6 +221,9 @@ int atomisp_q_video_buffers_to_css(struct atomisp_sub_device *asd, unsigned long irqflags; int err = 0; + if (WARN_ON(css_pipe_id >= IA_CSS_PIPE_ID_NUM)) + return -EINVAL; + while (pipe->buffers_in_css < ATOMISP_CSS_Q_DEPTH) { struct videobuf_buffer *vb;
--
2.30.2