Re: [PATCH 6/6] media: amlogic-c3: Add validations for ae and awb config

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

Hi Ricardo,

Thank you for the patch.

CC'ing Jacopo.

On Tue, Apr 28, 2026 at 12:41:12PM +0000, Ricardo Ribalda wrote:
> Avoid invalid memory access if the zones_num is bigger than
> zone_weight.
> 
> This patch fixes the following smatch errors:
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> 
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
>  drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> index 6f9ca7a7dd88..42d780f684d1 100644
> --- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> +++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> @@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
>  	c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
>  
>  	zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> +	if (WARN_ON(zones_num > C3_ISP_AWB_MAX_ZONES))

This is triggerable by userspace, it shouldn't result in a WARN_ON().
Ideally the horiz_zones_num and vert_zones_num should be validated at
buf prepare time, and an error should be returned to userspace. That
will likely not fix your smatch issue though, I don't think it will be
able to understand that the values have been validated.

Jacopo, do we need to add a validate function pointer to
v4l2_isp_params_block_type_info ?

> +		zones_num = C3_ISP_AWB_MAX_ZONES;
>  
>  	/* Need to write 8 weights at once */
>  	for (i = 0; i < zones_num / 8; i++) {
> @@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
>  	c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
>  
>  	zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> +	if (WARN_ON(zones_num > C3_ISP_AE_MAX_ZONES))
> +		zones_num = C3_ISP_AE_MAX_ZONES;
>  
>  	/* Need to write 8 weights at once */
>  	for (i = 0; i < zones_num / 8; i++) {
> 

-- 
Regards,

Laurent Pinchart