* [PATCH] media: omap3isp: handle NULL return of omap3isp_video_format_info() in ccdc_is_shiftable().
@ 2017-06-26 17:54 H. Nikolaus Schaller
2017-06-26 20:12 ` Sakari Ailus
0 siblings, 1 reply; 4+ messages in thread
From: H. Nikolaus Schaller @ 2017-06-26 17:54 UTC (permalink / raw)
To: Laurent Pinchart, Mauro Carvalho Chehab, s-anna
Cc: linux-media, linux-kernel, letux-kernel, H. Nikolaus Schaller
If a camera module driver specifies a format that is not
supported by omap3isp this ends in a NULL pointer
dereference instead of a simple fail.
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
---
drivers/media/platform/omap3isp/ispccdc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
index 2fb755f20a6b..dcf16ee7c612 100644
--- a/drivers/media/platform/omap3isp/ispccdc.c
+++ b/drivers/media/platform/omap3isp/ispccdc.c
@@ -2397,6 +2397,9 @@ static bool ccdc_is_shiftable(u32 in, u32 out, unsigned int additional_shift)
in_info = omap3isp_video_format_info(in);
out_info = omap3isp_video_format_info(out);
+ if (!in_info || !out_info)
+ return false;
+
if ((in_info->flavor == 0) || (out_info->flavor == 0))
return false;
--
2.12.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] media: omap3isp: handle NULL return of omap3isp_video_format_info() in ccdc_is_shiftable().
2017-06-26 17:54 [PATCH] media: omap3isp: handle NULL return of omap3isp_video_format_info() in ccdc_is_shiftable() H. Nikolaus Schaller
@ 2017-06-26 20:12 ` Sakari Ailus
2017-06-27 5:46 ` H. Nikolaus Schaller
0 siblings, 1 reply; 4+ messages in thread
From: Sakari Ailus @ 2017-06-26 20:12 UTC (permalink / raw)
To: H. Nikolaus Schaller
Cc: Laurent Pinchart, Mauro Carvalho Chehab, s-anna, linux-media,
linux-kernel, letux-kernel
Hi Nikolaus,
On Mon, Jun 26, 2017 at 07:54:19PM +0200, H. Nikolaus Schaller wrote:
> If a camera module driver specifies a format that is not
> supported by omap3isp this ends in a NULL pointer
> dereference instead of a simple fail.
Has this happened in practice? If it does, it is probably a driver bug ---
the formats on its pads should be recognised by the driver.
WARN_ON() around the condition would be good to avoid silently ignoring such
issues.
I wonder what Laurent thinks.
>
> Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
> ---
> drivers/media/platform/omap3isp/ispccdc.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
> index 2fb755f20a6b..dcf16ee7c612 100644
> --- a/drivers/media/platform/omap3isp/ispccdc.c
> +++ b/drivers/media/platform/omap3isp/ispccdc.c
> @@ -2397,6 +2397,9 @@ static bool ccdc_is_shiftable(u32 in, u32 out, unsigned int additional_shift)
> in_info = omap3isp_video_format_info(in);
> out_info = omap3isp_video_format_info(out);
>
> + if (!in_info || !out_info)
> + return false;
> +
> if ((in_info->flavor == 0) || (out_info->flavor == 0))
> return false;
>
--
Regards,
Sakari Ailus
e-mail: sakari.ailus@iki.fi XMPP: sailus@retiisi.org.uk
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: omap3isp: handle NULL return of omap3isp_video_format_info() in ccdc_is_shiftable().
2017-06-26 20:12 ` Sakari Ailus
@ 2017-06-27 5:46 ` H. Nikolaus Schaller
2017-06-27 5:57 ` Sakari Ailus
0 siblings, 1 reply; 4+ messages in thread
From: H. Nikolaus Schaller @ 2017-06-27 5:46 UTC (permalink / raw)
To: Sakari Ailus
Cc: Laurent Pinchart, Mauro Carvalho Chehab, s-anna, linux-media,
linux-kernel, letux-kernel
Hi,
> Am 26.06.2017 um 22:12 schrieb Sakari Ailus <sakari.ailus@iki.fi>:
>
> Hi Nikolaus,
>
> On Mon, Jun 26, 2017 at 07:54:19PM +0200, H. Nikolaus Schaller wrote:
>> If a camera module driver specifies a format that is not
>> supported by omap3isp this ends in a NULL pointer
>> dereference instead of a simple fail.
>
> Has this happened in practice?
Yes. I wouldn't have noticed it otherwise.
It happens with a new ov965x driver just submitted for review.
It seems to provide some format that the omap3isp does not understand.
I can send you a console stack log if needed.
> If it does, it is probably a driver bug ---
> the formats on its pads should be recognised by the driver.
>
> WARN_ON() around the condition would be good to avoid silently ignoring such
> issues.
>
> I wonder what Laurent thinks.
>
>>
>> Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
>> ---
>> drivers/media/platform/omap3isp/ispccdc.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
>> index 2fb755f20a6b..dcf16ee7c612 100644
>> --- a/drivers/media/platform/omap3isp/ispccdc.c
>> +++ b/drivers/media/platform/omap3isp/ispccdc.c
>> @@ -2397,6 +2397,9 @@ static bool ccdc_is_shiftable(u32 in, u32 out, unsigned int additional_shift)
>> in_info = omap3isp_video_format_info(in);
>> out_info = omap3isp_video_format_info(out);
>>
>> + if (!in_info || !out_info)
>> + return false;
>> +
>> if ((in_info->flavor == 0) || (out_info->flavor == 0))
>> return false;
>>
>
> --
> Regards,
>
> Sakari Ailus
> e-mail: sakari.ailus@iki.fi XMPP: sailus@retiisi.org.uk
BR and thanks,
Nikolaus
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: omap3isp: handle NULL return of omap3isp_video_format_info() in ccdc_is_shiftable().
2017-06-27 5:46 ` H. Nikolaus Schaller
@ 2017-06-27 5:57 ` Sakari Ailus
0 siblings, 0 replies; 4+ messages in thread
From: Sakari Ailus @ 2017-06-27 5:57 UTC (permalink / raw)
To: H. Nikolaus Schaller
Cc: Laurent Pinchart, Mauro Carvalho Chehab, s-anna, linux-media,
linux-kernel, letux-kernel
Hi Nikolaus,
On Tue, Jun 27, 2017 at 07:46:51AM +0200, H. Nikolaus Schaller wrote:
> Hi,
>
> > Am 26.06.2017 um 22:12 schrieb Sakari Ailus <sakari.ailus@iki.fi>:
> >
> > Hi Nikolaus,
> >
> > On Mon, Jun 26, 2017 at 07:54:19PM +0200, H. Nikolaus Schaller wrote:
> >> If a camera module driver specifies a format that is not
> >> supported by omap3isp this ends in a NULL pointer
> >> dereference instead of a simple fail.
> >
> > Has this happened in practice?
>
> Yes. I wouldn't have noticed it otherwise.
>
> It happens with a new ov965x driver just submitted for review.
> It seems to provide some format that the omap3isp does not understand.
>
> I can send you a console stack log if needed.
No need to. I think indeed what was missed is that the code may come from
elsewhere than the omap3isp driver pads themselves where it already has been
validated. Adding a comment saying that wouldn't hurt IMO.
I think the following change should be probably made as well. Feel free to
merge to the same patch.
diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
index 7207558..71de993 100644
--- a/drivers/media/platform/omap3isp/ispccdc.c
+++ b/drivers/media/platform/omap3isp/ispccdc.c
@@ -1160,7 +1160,8 @@ static void ccdc_configure(struct isp_ccdc_device *ccdc)
fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
if (!v4l2_subdev_call(sensor, pad, get_fmt, NULL, &fmt_src)) {
fmt_info = omap3isp_video_format_info(fmt_src.format.code);
- depth_in = fmt_info->width;
+ if (fmt_info)
+ depth_in = fmt_info->width;
}
fmt_info = omap3isp_video_format_info(format->code);
>
> > If it does, it is probably a driver bug ---
> > the formats on its pads should be recognised by the driver.
>
> >
> > WARN_ON() around the condition would be good to avoid silently ignoring such
> > issues.
> >
> > I wonder what Laurent thinks.
> >
> >>
> >> Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
> >> ---
> >> drivers/media/platform/omap3isp/ispccdc.c | 3 +++
> >> 1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
> >> index 2fb755f20a6b..dcf16ee7c612 100644
> >> --- a/drivers/media/platform/omap3isp/ispccdc.c
> >> +++ b/drivers/media/platform/omap3isp/ispccdc.c
> >> @@ -2397,6 +2397,9 @@ static bool ccdc_is_shiftable(u32 in, u32 out, unsigned int additional_shift)
> >> in_info = omap3isp_video_format_info(in);
> >> out_info = omap3isp_video_format_info(out);
> >>
> >> + if (!in_info || !out_info)
> >> + return false;
> >> +
> >> if ((in_info->flavor == 0) || (out_info->flavor == 0))
> >> return false;
> >>
--
Regards,
Sakari Ailus
e-mail: sakari.ailus@iki.fi XMPP: sailus@retiisi.org.uk
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-06-27 5:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-26 17:54 [PATCH] media: omap3isp: handle NULL return of omap3isp_video_format_info() in ccdc_is_shiftable() H. Nikolaus Schaller
2017-06-26 20:12 ` Sakari Ailus
2017-06-27 5:46 ` H. Nikolaus Schaller
2017-06-27 5:57 ` Sakari Ailus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).