* [PATCH v3] media: i2c: max9286: Fix async subdev size
@ 2020-09-16 14:27 Jacopo Mondi
0 siblings, 0 replies; only message in thread
From: Jacopo Mondi @ 2020-09-16 14:27 UTC (permalink / raw)
To: Kieran Bingham, Laurent Pinchart, Niklas Söderlund,
Mauro Carvalho Chehab
Cc: Jacopo Mondi, linux-renesas-soc, linux-media, Laurent Pinchart
Since commit 86d37bf31af6 ("media: i2c: max9286: Allocate
v4l2_async_subdev dynamically") the async subdevice registered to the
max9286 notifier is dynamically allocated by the v4l2 framework by using
the v4l2_async_notifier_add_fwnode_subdev() function, but provides an
incorrect size, potentially leading to incorrect memory accesses.
Allocate enough space for the driver specific max9286_asd structure
(which contains the async subdevice) by passing the size of the correct
structure.
Fixes: 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
---
v2->v3:
- Reword commit message as suggested by Kieran.
---
drivers/media/i2c/max9286.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
index c82c1493e099..6852448284ea 100644
--- a/drivers/media/i2c/max9286.c
+++ b/drivers/media/i2c/max9286.c
@@ -577,10 +577,11 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
for_each_source(priv, source) {
unsigned int i = to_index(priv, source);
struct v4l2_async_subdev *asd;
+ struct max9286_asd *masd;
asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier,
source->fwnode,
- sizeof(*asd));
+ sizeof(*masd));
if (IS_ERR(asd)) {
dev_err(dev, "Failed to add subdev for source %u: %ld",
i, PTR_ERR(asd));
@@ -588,7 +589,8 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
return PTR_ERR(asd);
}
- to_max9286_asd(asd)->source = source;
+ masd = to_max9286_asd(asd);
+ masd->source = source;
}
priv->notifier.ops = &max9286_notify_ops;
--
2.28.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2020-09-16 20:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-16 14:27 [PATCH v3] media: i2c: max9286: Fix async subdev size Jacopo Mondi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).