diff mbox

[1/2] rcar-vin: Verify pads on linkage

Message ID 1493057627-27881-1-git-send-email-kbingham@kernel.org (mailing list archive)
State Not Applicable
Delegated to: Geert Uytterhoeven
Headers show

Commit Message

Kieran Bingham April 24, 2017, 6:13 p.m. UTC 
From: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>

The current code determines the pad from the identifiers in the DTB.
This is accepted without bounds in the driver.

Invalid port/reg addresses defined in the DTB will cause a kernel panic
when dereferencing non-existing pads.

Protect the linkage with a check that the pad numbers are valid.

Signed-off-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
---
 drivers/media/platform/rcar-vin/rcar-core.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
diff mbox

Patch

diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
index 893018963847..48557628e76d 100644
--- a/drivers/media/platform/rcar-vin/rcar-core.c
+++ b/drivers/media/platform/rcar-vin/rcar-core.c
@@ -613,6 +613,18 @@  static int rvin_group_add_link(struct rvin_dev *vin,
 	struct media_pad *source_pad, *sink_pad;
 	int ret = 0;
 
+	if (source_idx >= source->num_pads) {
+		vin_err(vin, "Source pad idx %d is greater than pad count %d\n",
+			source_idx, source->num_pads);
+		return -EINVAL;
+	}
+
+	if (sink_idx >= sink->num_pads) {
+		vin_err(vin, "Sink pad idx %d is greater than pad count %d\n",
+			source_idx, source->num_pads);
+		return -EINVAL;
+	}
+
 	source_pad = &source->pads[source_idx];
 	sink_pad = &sink->pads[sink_idx];