| Message ID | 20240624084123.3009122-1-alain.volmat@foss.st.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs | expand |
On 24/06/2024 10:41, Alain Volmat wrote: > Correct error handling within the dcmipp_create_subdevs by properly > decrementing the i counter when releasing the subdeves. > > Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") > Cc: stable@vger.kernel.org > Signed-off-by: Alain Volmat <alain.volmat@foss.st.com> > --- > drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > index 4acc3b90d03a..4924ee36cfda 100644 > --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > @@ -202,7 +202,7 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp) > return 0; > > err_init_entity: > - while (i > 0) > + while (i-- > 0) > dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]); > return ret; > } I accidentally merged this one, but this patch isn't right. After this change the [i - 1] indices should be changed to [i]. If i == 1, then the while condition is true, but now i == 0 in the actual statement, so you access out-of-bounds values. I decided to revert it, since it is better to just get stuck in the while loop, then to crash. But a new patch is needed for this. Regards, Hans
Hi Hans, On Thu, Jun 27, 2024 at 01:17:55PM +0200, Hans Verkuil wrote: > On 24/06/2024 10:41, Alain Volmat wrote: > > Correct error handling within the dcmipp_create_subdevs by properly > > decrementing the i counter when releasing the subdeves. > > > > Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") > > Cc: stable@vger.kernel.org > > Signed-off-by: Alain Volmat <alain.volmat@foss.st.com> > > --- > > drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > > index 4acc3b90d03a..4924ee36cfda 100644 > > --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > > +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > > @@ -202,7 +202,7 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp) > > return 0; > > > > err_init_entity: > > - while (i > 0) > > + while (i-- > 0) > > dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]); > > return ret; > > } > > I accidentally merged this one, but this patch isn't right. > > After this change the [i - 1] indices should be changed to [i]. > If i == 1, then the while condition is true, but now i == 0 in the > actual statement, so you access out-of-bounds values. Right. I think the best way to fix this would be to just remove "- 1" inside the array indices. One could think this as a different bug but of course with an unpleasant side effect which you get after fixing the first bug. > > I decided to revert it, since it is better to just get stuck in the > while loop, then to crash. > > But a new patch is needed for this.
diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c index 4acc3b90d03a..4924ee36cfda 100644 --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c @@ -202,7 +202,7 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp) return 0; err_init_entity: - while (i > 0) + while (i-- > 0) dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]); return ret; }
Correct error handling within the dcmipp_create_subdevs by properly decrementing the i counter when releasing the subdeves. Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") Cc: stable@vger.kernel.org Signed-off-by: Alain Volmat <alain.volmat@foss.st.com> --- drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)