linux-media.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Niklas Söderlund" <niklas.soderlund@ragnatech.se>
To: Nadezda Lutovinova <lutovinova@ispras.ru>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>,
	linux-media@vger.kernel.org, linux-renesas-soc@vger.kernel.org,
	linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org
Subject: Re: [PATCH] media: rcar-csi2: Add checking to rcsi2_start_receiver().
Date: Wed, 11 Aug 2021 15:45:42 +0200	[thread overview]
Message-ID: <YRPUhqvcTxCVvnBG@oden.dyn.berto.se> (raw)
In-Reply-To: <20210811133142.13363-1-lutovinova@ispras.ru>

Hi Nadezda,

Thanks for your work.

On 2021-08-11 16:31:42 +0300, Nadezda Lutovinova wrote:
> If rcsi2_code_to_fmt() return NULL,
> then null pointer dereference occurs in the next cycle.
> The patch adds checking if format is NULL.
> 
> Found by Linux Driver Verification project (linuxtesting.org).

Please drop the '.' at the end of the patch subject. Also the commit 
message could be better line wrapped.

> 
> Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
> ---
>  drivers/media/platform/rcar-vin/rcar-csi2.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
> index e28eff039688..55bb584d2a13 100644
> --- a/drivers/media/platform/rcar-vin/rcar-csi2.c
> +++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
> @@ -553,6 +553,12 @@ static int rcsi2_start_receiver(struct rcar_csi2 *priv)
>  
>  	/* Code is validated in set_fmt. */
>  	format = rcsi2_code_to_fmt(priv->mf.code);
> +	if (!format) {

This can never happen ;-)

The only place priv->mf.code is set (after probe) is in  
rcsi2_set_pad_format() and there it explicitly checks if 
rcsi2_code_to_fmt() returns NULl and if so sets it to something that 
guarantees it will not.

Think of it as the verification is done at format configuration time so 
we don't have to have check it at start time. The reason for this is 
that we can't do much about a failure here other then fail the start 
while at configure time we can try to correct it and inform the user of 
the change.

That being said, I'm not oppose to fail the start here if we ever do 
introduce a bug here where rcsi2_code_to_fmt() would return NULL here.  
But I would like to drop the dev_err() here and just return -EINVAL.

I would mention in the commit message that this protects from future 
bugs.

> +		dev_err(priv->dev,
> +			"Incorrect mbus frame format code %u\n",
> +			priv->mf.code);
> +		return -EINVAL;
> +	}
>  
>  	/*
>  	 * Enable all supported CSI-2 channels with virtual channel and
> -- 
> 2.17.1
> 

-- 
Regards,
Niklas Söderlund

  reply	other threads:[~2021-08-11 13:45 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-11 13:31 Nadezda Lutovinova
2021-08-11 13:45 ` Niklas Söderlund [this message]
2021-08-11 17:18   ` [PATCH v2] " Nadezda Lutovinova
2021-08-12  9:16     ` Jacopo Mondi
2021-08-12  9:30     ` Niklas Söderlund

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YRPUhqvcTxCVvnBG@oden.dyn.berto.se \
    --to=niklas.soderlund@ragnatech.se \
    --cc=ldv-project@linuxtesting.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=linux-renesas-soc@vger.kernel.org \
    --cc=lutovinova@ispras.ru \
    --cc=mchehab@kernel.org \
    --subject='Re: [PATCH] media: rcar-csi2: Add checking to rcsi2_start_receiver().' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).