diff mbox series

[2/2] media: intel/ipu6: add csi2 port sanity check in notifier bound

Message ID 20240529034600.117803-1-bingbu.cao@intel.com (mailing list archive)
State New
Headers show
Series [1/2] media: intel/ipu6: update the maximum supported csi2 port number to 6 | expand

Commit Message

Bingbu Cao May 29, 2024, 3:46 a.m. UTC
From: Bingbu Cao <bingbu.cao@intel.com>

Invalid csi2 port will break the isys notifier bound ops as it is
trying to access an invalid csi2 sub-device instance based on the
port. It will trigger a mc warning, and it will cause the sensor
driver to unbound an inexistent isys csi2 and crash. Adding a
csi2 port sanity check, return error to avoid such case.

Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
---
 drivers/media/pci/intel/ipu6/ipu6-isys.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Sakari Ailus May 29, 2024, 6:04 a.m. UTC | #1
Hi Bingbu,

Thanks for the patch.

On Wed, May 29, 2024 at 11:46:00AM +0800, bingbu.cao@intel.com wrote:
> From: Bingbu Cao <bingbu.cao@intel.com>
> 
> Invalid csi2 port will break the isys notifier bound ops as it is
> trying to access an invalid csi2 sub-device instance based on the
> port. It will trigger a mc warning, and it will cause the sensor
> driver to unbound an inexistent isys csi2 and crash. Adding a
> csi2 port sanity check, return error to avoid such case.
> 
> Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
> ---
>  drivers/media/pci/intel/ipu6/ipu6-isys.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys.c b/drivers/media/pci/intel/ipu6/ipu6-isys.c
> index 5992138c7290..997fbfbf2ea5 100644
> --- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
> +++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
> @@ -676,8 +676,16 @@ static int isys_notifier_bound(struct v4l2_async_notifier *notifier,
>  		container_of(notifier, struct ipu6_isys, notifier);
>  	struct sensor_async_sd *s_asd =
>  		container_of(asc, struct sensor_async_sd, asc);
> +	u32 nports;
>  	int ret;
>  
> +	nports = isys->pdata->ipdata->csi2.nports;
> +	if (nports <= s_asd->csi2.port) {

No need for a temporary variable. I'd also put the non-static value
(s_asd->csi2.port) on the left side of the comparison.

> +		dev_err(&isys->adev->auxdev.dev, "invalid csi2 port %u\n",
> +			s_asd->csi2.port);
> +		return -EINVAL;
> +	}
> +
>  	ret = ipu_bridge_instantiate_vcm(sd->dev);
>  	if (ret) {
>  		dev_err(&isys->adev->auxdev.dev, "instantiate vcm failed\n");
diff mbox series

Patch

diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys.c b/drivers/media/pci/intel/ipu6/ipu6-isys.c
index 5992138c7290..997fbfbf2ea5 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
@@ -676,8 +676,16 @@  static int isys_notifier_bound(struct v4l2_async_notifier *notifier,
 		container_of(notifier, struct ipu6_isys, notifier);
 	struct sensor_async_sd *s_asd =
 		container_of(asc, struct sensor_async_sd, asc);
+	u32 nports;
 	int ret;
 
+	nports = isys->pdata->ipdata->csi2.nports;
+	if (nports <= s_asd->csi2.port) {
+		dev_err(&isys->adev->auxdev.dev, "invalid csi2 port %u\n",
+			s_asd->csi2.port);
+		return -EINVAL;
+	}
+
 	ret = ipu_bridge_instantiate_vcm(sd->dev);
 	if (ret) {
 		dev_err(&isys->adev->auxdev.dev, "instantiate vcm failed\n");