github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: i2c: adv7604: Add range checks for chip info

Browse Source 
If the driver's chip information is invalid we can end up accessing an
invalid memory region.

This fixes the following false positive smatch errors:
drivers/media/i2c/adv7604.c:3672 adv76xx_probe() error: buffer overflow 'state->pads' 7 <= 4294967294
drivers/media/i2c/adv7604.c:3673 adv76xx_probe() error: buffer overflow 'state->pads' 7 <= u32max

Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Ricardo Ribalda 2026-05-07 20:58:08 +00:00 committed by Hans Verkuil
parent 508afd8060
commit ddf9d68a36
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/i2c/adv7604.c
View File

@ -3668,6 +3668,12 @@ static int adv76xx_probe(struct i2c_client *client)
state->source_pad = state->info->num_dv_ports
+ (state->info->has_afe ? 2 : 0);
if (WARN_ON(state->source_pad >= ADV76XX_PAD_MAX)) {
err = -EINVAL;
v4l2_err(sd, "invalid chip info\n");
goto err_i2c;
}
for (i = 0; i < state->source_pad; ++i)
state->pads[i].flags = MEDIA_PAD_FL_SINK;
state->pads[state->source_pad].flags = MEDIA_PAD_FL_SOURCE;