* [PATCH v2] media: i2c: max9286: Fix async subdev size
@ 2020-09-15 12:39 Jacopo Mondi
2020-09-16 11:00 ` Kieran Bingham
0 siblings, 1 reply; 3+ messages in thread
From: Jacopo Mondi @ 2020-09-15 12:39 UTC (permalink / raw)
To: Kieran Bingham, Laurent Pinchart, Niklas Söderlund,
Mauro Carvalho Chehab
Cc: Jacopo Mondi, linux-renesas-soc, linux-media, Laurent Pinchart
Since
commit 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
the async subdevice registered to the max9286 notifier is dynamically
allocated by the v4l2 framework by using the
v4l2_async_notifier_add_fwnode_subdev() function. In order to allocate
enough space for max9286_asd structure that encloses the async subdevice
paired with a pointer to the corresponding source, pass to the framework
the size of the whole structure in place of the one of the enclosed async
subdev.
Fixes: 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
---
drivers/media/i2c/max9286.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
index c82c1493e099..6852448284ea 100644
--- a/drivers/media/i2c/max9286.c
+++ b/drivers/media/i2c/max9286.c
@@ -577,10 +577,11 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
for_each_source(priv, source) {
unsigned int i = to_index(priv, source);
struct v4l2_async_subdev *asd;
+ struct max9286_asd *masd;
asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier,
source->fwnode,
- sizeof(*asd));
+ sizeof(*masd));
if (IS_ERR(asd)) {
dev_err(dev, "Failed to add subdev for source %u: %ld",
i, PTR_ERR(asd));
@@ -588,7 +589,8 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
return PTR_ERR(asd);
}
- to_max9286_asd(asd)->source = source;
+ masd = to_max9286_asd(asd);
+ masd->source = source;
}
priv->notifier.ops = &max9286_notify_ops;
--
2.28.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] media: i2c: max9286: Fix async subdev size
2020-09-15 12:39 [PATCH v2] media: i2c: max9286: Fix async subdev size Jacopo Mondi
@ 2020-09-16 11:00 ` Kieran Bingham
2020-09-16 11:18 ` Jacopo Mondi
0 siblings, 1 reply; 3+ messages in thread
From: Kieran Bingham @ 2020-09-16 11:00 UTC (permalink / raw)
To: Jacopo Mondi, Laurent Pinchart, Niklas Söderlund,
Mauro Carvalho Chehab
Cc: linux-renesas-soc, linux-media, Laurent Pinchart
Hi Jacopo,
On 15/09/2020 13:39, Jacopo Mondi wrote:
> Since
Does 'Since' really need it's own line ;-)
> commit 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
> the async subdevice registered to the max9286 notifier is dynamically
> allocated by the v4l2 framework by using the
> v4l2_async_notifier_add_fwnode_subdev() function. In order to allocate
A newline before 'In order to' would be nice to split 'what happened'
from 'what is going to happen'. Oh, in fact it doesn't describe what
happened though...
> enough space for max9286_asd structure that encloses the async subdevice
for "the" max9286_asd...
> paired with a pointer to the corresponding source, pass to the framework
> the size of the whole structure in place of the one of the enclosed async
> subdev.
That's quite hard to parse though, and I don't think describing the
contents of max9286_asd really matters here?
How about:
Since commit 86d37bf31af6 ("media: i2c: max9286: Allocate
v4l2_async_subdev dynamically") the async subdevice registered to the
max9286 notifier is dynamically allocated by the v4l2 framework by using
the v4l2_async_notifier_add_fwnode_subdev() function, but provides an
incorrect size, potentially leading to incorrect memory accesses.
Allocate enough space for the driver specific max9286_asd structure
(which contains the async subdevice) by passing the size of the correct
structure.
> Fixes: 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
The code is fine though, so with any commit message updates you deem
necessary:
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
> Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
> ---
> drivers/media/i2c/max9286.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
> index c82c1493e099..6852448284ea 100644
> --- a/drivers/media/i2c/max9286.c
> +++ b/drivers/media/i2c/max9286.c
> @@ -577,10 +577,11 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
> for_each_source(priv, source) {
> unsigned int i = to_index(priv, source);
> struct v4l2_async_subdev *asd;
> + struct max9286_asd *masd;
>
> asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier,
> source->fwnode,
> - sizeof(*asd));
> + sizeof(*masd));
> if (IS_ERR(asd)) {
> dev_err(dev, "Failed to add subdev for source %u: %ld",
> i, PTR_ERR(asd));
> @@ -588,7 +589,8 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
> return PTR_ERR(asd);
> }
>
> - to_max9286_asd(asd)->source = source;
> + masd = to_max9286_asd(asd);
> + masd->source = source;
> }
>
> priv->notifier.ops = &max9286_notify_ops;
> --
> 2.28.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] media: i2c: max9286: Fix async subdev size
2020-09-16 11:00 ` Kieran Bingham
@ 2020-09-16 11:18 ` Jacopo Mondi
0 siblings, 0 replies; 3+ messages in thread
From: Jacopo Mondi @ 2020-09-16 11:18 UTC (permalink / raw)
To: Kieran Bingham
Cc: Jacopo Mondi, Laurent Pinchart, Niklas Söderlund,
Mauro Carvalho Chehab, linux-renesas-soc, linux-media,
Laurent Pinchart
Hi Kieran,
On Wed, Sep 16, 2020 at 12:00:53PM +0100, Kieran Bingham wrote:
> Hi Jacopo,
>
> On 15/09/2020 13:39, Jacopo Mondi wrote:
> > Since
>
> Does 'Since' really need it's own line ;-)
>
If you don't want to break the following one (which I understand is
better on a single line) yes
> > commit 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
> > the async subdevice registered to the max9286 notifier is dynamically
> > allocated by the v4l2 framework by using the
> > v4l2_async_notifier_add_fwnode_subdev() function. In order to allocate
>
> A newline before 'In order to' would be nice to split 'what happened'
> from 'what is going to happen'. Oh, in fact it doesn't describe what
> happened though...
>
> > enough space for max9286_asd structure that encloses the async subdevice
>
> for "the" max9286_asd...
>
>
> > paired with a pointer to the corresponding source, pass to the framework
> > the size of the whole structure in place of the one of the enclosed async
> > subdev.
>
> That's quite hard to parse though, and I don't think describing the
> contents of max9286_asd really matters here?
>
> How about:
>
> Since commit 86d37bf31af6 ("media: i2c: max9286: Allocate
> v4l2_async_subdev dynamically") the async subdevice registered to the
> max9286 notifier is dynamically allocated by the v4l2 framework by using
> the v4l2_async_notifier_add_fwnode_subdev() function, but provides an
> incorrect size, potentially leading to incorrect memory accesses.
>
> Allocate enough space for the driver specific max9286_asd structure
> (which contains the async subdevice) by passing the size of the correct
> structure.
>
> > Fixes: 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically")
> > Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
>
> The code is fine though, so with any commit message updates you deem
> necessary:
>
> Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Ok, better than mine, I'll take it in.
Thanks.
j
>
> > Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
> > ---
> > drivers/media/i2c/max9286.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
> > index c82c1493e099..6852448284ea 100644
> > --- a/drivers/media/i2c/max9286.c
> > +++ b/drivers/media/i2c/max9286.c
> > @@ -577,10 +577,11 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
> > for_each_source(priv, source) {
> > unsigned int i = to_index(priv, source);
> > struct v4l2_async_subdev *asd;
> > + struct max9286_asd *masd;
> >
> > asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier,
> > source->fwnode,
> > - sizeof(*asd));
> > + sizeof(*masd));
> > if (IS_ERR(asd)) {
> > dev_err(dev, "Failed to add subdev for source %u: %ld",
> > i, PTR_ERR(asd));
> > @@ -588,7 +589,8 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv)
> > return PTR_ERR(asd);
> > }
> >
> > - to_max9286_asd(asd)->source = source;
> > + masd = to_max9286_asd(asd);
> > + masd->source = source;
> > }
> >
> > priv->notifier.ops = &max9286_notify_ops;
> > --
> > 2.28.0
> >
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-09-16 20:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-15 12:39 [PATCH v2] media: i2c: max9286: Fix async subdev size Jacopo Mondi
2020-09-16 11:00 ` Kieran Bingham
2020-09-16 11:18 ` Jacopo Mondi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).