commit 445d02849df4971db6173d62a4aee1674b37b7f5
author Tomi Valkeinen <tomi.valkeinen@ideasonboard.com> Mon Jan 18 10:14:46 2021 +0200
committer Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Wed Jan 20 12:30:03 2021 +0000
tree 30b9c0f3970505de52c44fc2ff859fa76ad061f3
parent b269d6f41e2159c29f3df931a2f68e3397cc5c2e

media: i2c: max9286: fix access to unallocated memory

The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be
of size max9286_asd, otherwise access to max9286_asd->source will go to
unallocated memory.

Fixes: 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>

drivers/media/i2c/max9286.c

diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
index 66d3e04..87e4fa2 100644
--- a/drivers/media/i2c/max9286.c
+++ b/drivers/media/i2c/max9286.c
@@ -715,7 +715,7 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
 
 		asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier,
 							    source->fwnode,
-							    sizeof(*asd));
+							    sizeof(struct max9286_asd));
 		if (IS_ERR(asd)) {
 			dev_err(dev, "Failed to add subdev for source %u: %ld",
 				i, PTR_ERR(asd));