github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: amlogic-c3: Add validations for ae and awb config

Browse Source 
Avoid invalid memory access if the zones_num is bigger than
zone_weight.

This patch fixes the following smatch errors:
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max

Cc: stable@vger.kernel.org
Fixes: fb2e135208 ("media: platform: Add C3 ISP driver")
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Keke Li <keke.li@amlogic.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Ricardo Ribalda 2026-05-07 20:58:11 +00:00 committed by Hans Verkuil
parent c32fe4c491
commit 9724164f71
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
View File

@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
if (zones_num > C3_ISP_AWB_MAX_ZONES)
zones_num = C3_ISP_AWB_MAX_ZONES;
/* Need to write 8 weights at once */
for (i = 0; i < zones_num / 8; i++) {
@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
if (zones_num > C3_ISP_AE_MAX_ZONES)
zones_num = C3_ISP_AE_MAX_ZONES;
/* Need to write 8 weights at once */
for (i = 0; i < zones_num / 8; i++) {