From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A996C4167E for ; Wed, 30 Mar 2022 11:55:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241305AbiC3L5F (ORCPT ); Wed, 30 Mar 2022 07:57:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344347AbiC3Lw6 (ORCPT ); Wed, 30 Mar 2022 07:52:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 61E38261308; Wed, 30 Mar 2022 04:48:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C225D615B7; Wed, 30 Mar 2022 11:48:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F8F2C340F3; Wed, 30 Mar 2022 11:48:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648640916; bh=1mzmburc3X+szuNAEo1tXUhYMeph1aGhucbEOTahC2s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MCaFdqWqHpx55IIGCibFaXQKVxehUIrT95PWcEwp180Q9Rvkzf4ZLHzRBDywLc3tg UoZrNx7r8WrSG35Ww28wyDMs/+/2MbHVKdlJORe8R6NUicZI13NjcHvgpVFuN83nNC gd3q1vQOnIjq1NKit86O1IfORQZIKt9xq0RWWsrgKDXvtpnq3Sn3228I+IiD62kBR1 UUZ7FL5hd0nZBlOBkxMu5TaHuAGV8vg2+5AoFGOeL6fy8quSHRs9QYjLmuasBgWRow V7Gchq3I6A3XwCueWEv5xohF7A2XOv3AqsZD23a6Yw2MYnzYpSQp7d13N/H+gTORNm wAgJL3+1XAJ8g== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Corentin Labbe , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin , gregkh@linuxfoundation.org, linux-media@vger.kernel.org, devel@driverdev.osuosl.org Subject: [PATCH AUTOSEL 5.16 02/59] media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Date: Wed, 30 Mar 2022 07:47:34 -0400 Message-Id: <20220330114831.1670235-2-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220330114831.1670235-1-sashal@kernel.org> References: <20220330114831.1670235-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Corentin Labbe [ Upstream commit e3b86f4e558cea9eed71d894df2f19b10d60a207 ] On the case tmp_dcim=1, the index of buffer is miscalculated. This generate a NULL pointer dereference later. So let's fix the calcul and add a check to prevent this to reappear. Signed-off-by: Corentin Labbe Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/staging/media/zoran/zoran_device.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/zoran/zoran_device.c b/drivers/staging/media/zoran/zoran_device.c index 5b12a730a229..fb1f0465ca87 100644 --- a/drivers/staging/media/zoran/zoran_device.c +++ b/drivers/staging/media/zoran/zoran_device.c @@ -814,7 +814,7 @@ static void zoran_reap_stat_com(struct zoran *zr) if (zr->jpg_settings.tmp_dcm == 1) i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM; else - i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1; + i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2; stat_com = le32_to_cpu(zr->stat_com[i]); if ((stat_com & 1) == 0) { @@ -826,6 +826,11 @@ static void zoran_reap_stat_com(struct zoran *zr) size = (stat_com & GENMASK(22, 1)) >> 1; buf = zr->inuse[i]; + if (!buf) { + spin_unlock_irqrestore(&zr->queued_bufs_lock, flags); + pci_err(zr->pci_dev, "No buffer at slot %d\n", i); + return; + } buf->vbuf.vb2_buf.timestamp = ktime_get_ns(); if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) { -- 2.34.1