* [PATCH] media: atomisp: Fix a pointer math problem in dump_sp_dmem()
@ 2020-06-16 9:27 Dan Carpenter
2020-06-16 9:51 ` Sakari Ailus
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2020-06-16 9:27 UTC (permalink / raw)
To: Mauro Carvalho Chehab; +Cc: devel, kernel-janitors, Sakari Ailus, linux-media
The "io_virt_addr" variable is a u32 pointer and it should be
incremented by one instead of four. The current code will dump bogus
data and read beyond the end of the buffer.
Fixes: 69a03e36c711 ("media: atomisp: get rid of an iomem abstraction layer")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 7b936e5a5f03..6faf223c6d20 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -682,7 +682,7 @@ void dump_sp_dmem(struct atomisp_device *isp, unsigned int addr,
do {
data = *io_virt_addr;
dev_dbg(isp->dev, "%s, \t [0x%x]:0x%x\n", __func__, addr, data);
- io_virt_addr += sizeof(u32);
+ io_virt_addr++;
size32 -= 1;
} while (size32 > 0);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] media: atomisp: Fix a pointer math problem in dump_sp_dmem()
2020-06-16 9:27 [PATCH] media: atomisp: Fix a pointer math problem in dump_sp_dmem() Dan Carpenter
@ 2020-06-16 9:51 ` Sakari Ailus
0 siblings, 0 replies; 2+ messages in thread
From: Sakari Ailus @ 2020-06-16 9:51 UTC (permalink / raw)
To: Dan Carpenter; +Cc: devel, Mauro Carvalho Chehab, kernel-janitors, linux-media
On Tue, Jun 16, 2020 at 12:27:28PM +0300, Dan Carpenter wrote:
> The "io_virt_addr" variable is a u32 pointer and it should be
> incremented by one instead of four. The current code will dump bogus
> data and read beyond the end of the buffer.
>
> Fixes: 69a03e36c711 ("media: atomisp: get rid of an iomem abstraction layer")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
--
Sakari Ailus
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-06-16 9:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-16 9:27 [PATCH] media: atomisp: Fix a pointer math problem in dump_sp_dmem() Dan Carpenter
2020-06-16 9:51 ` Sakari Ailus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).