From patchwork Mon Apr 24 18:13:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kieran Bingham X-Patchwork-Id: 9696893 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7FBCE603F2 for ; Mon, 24 Apr 2017 18:14:23 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 79DB228404 for ; Mon, 24 Apr 2017 18:14:23 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6EA842841C; Mon, 24 Apr 2017 18:14:23 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E679B28404 for ; Mon, 24 Apr 2017 18:14:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S975769AbdDXSOW (ORCPT ); Mon, 24 Apr 2017 14:14:22 -0400 Received: from mail.kernel.org ([198.145.29.136]:34764 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1428406AbdDXSNy (ORCPT ); Mon, 24 Apr 2017 14:13:54 -0400 Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 3F28B201C7; Mon, 24 Apr 2017 18:13:52 +0000 (UTC) Received: from CookieMonster.cookiemonster.local (cpc89242-aztw30-2-0-cust488.18-1.cable.virginm.net [86.31.129.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2100D20172; Mon, 24 Apr 2017 18:13:49 +0000 (UTC) From: Kieran Bingham To: niklas.soderlund@ragnatech.se Cc: linux-renesas-soc@vger.kernel.org, linux-media@vger.kernel.org, Kieran Bingham Subject: [PATCH 1/2] rcar-vin: Verify pads on linkage Date: Mon, 24 Apr 2017 19:13:47 +0100 Message-Id: <1493057627-27881-1-git-send-email-kbingham@kernel.org> X-Mailer: git-send-email 2.7.4 X-Virus-Scanned: ClamAV using ClamSMTP Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Kieran Bingham The current code determines the pad from the identifiers in the DTB. This is accepted without bounds in the driver. Invalid port/reg addresses defined in the DTB will cause a kernel panic when dereferencing non-existing pads. Protect the linkage with a check that the pad numbers are valid. Signed-off-by: Kieran Bingham --- drivers/media/platform/rcar-vin/rcar-core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c index 893018963847..48557628e76d 100644 --- a/drivers/media/platform/rcar-vin/rcar-core.c +++ b/drivers/media/platform/rcar-vin/rcar-core.c @@ -613,6 +613,18 @@ static int rvin_group_add_link(struct rvin_dev *vin, struct media_pad *source_pad, *sink_pad; int ret = 0; + if (source_idx >= source->num_pads) { + vin_err(vin, "Source pad idx %d is greater than pad count %d\n", + source_idx, source->num_pads); + return -EINVAL; + } + + if (sink_idx >= sink->num_pads) { + vin_err(vin, "Sink pad idx %d is greater than pad count %d\n", + source_idx, source->num_pads); + return -EINVAL; + } + source_pad = &source->pads[source_idx]; sink_pad = &sink->pads[sink_idx];