| From 489373d5425d45419dcdb9f011a670b3b1521711 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 12 Mar 2021 08:16:03 +0100 |
| Subject: atomisp: don't let it go past pipes array |
| |
| From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| |
| [ Upstream commit 1f6c45ac5fd70ab59136ab5babc7def269f3f509 ] |
| |
| In practice, IA_CSS_PIPE_ID_NUM should never be used when |
| calling atomisp_q_video_buffers_to_css(), as the driver should |
| discover the right pipe before calling it. |
| |
| Yet, if some pipe parsing issue happens, it could end using |
| it. |
| |
| So, add a WARN_ON() to prevent such case. |
| |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/staging/media/atomisp/pci/atomisp_fops.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c |
| index 453bb6913550..f1e6b2597853 100644 |
| --- a/drivers/staging/media/atomisp/pci/atomisp_fops.c |
| +++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c |
| @@ -221,6 +221,9 @@ int atomisp_q_video_buffers_to_css(struct atomisp_sub_device *asd, |
| unsigned long irqflags; |
| int err = 0; |
| |
| + if (WARN_ON(css_pipe_id >= IA_CSS_PIPE_ID_NUM)) |
| + return -EINVAL; |
| + |
| while (pipe->buffers_in_css < ATOMISP_CSS_Q_DEPTH) { |
| struct videobuf_buffer *vb; |
| |
| -- |
| 2.30.2 |
| |
