From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AAF16C2BD09 for ; Thu, 27 Jun 2024 11:30:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:In-Reply-To:Content-Type: MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=m3kMdlPWxedOCQGmiCScjMqbhkjsPVrCp1s+xkNW2Og=; b=1XW2RUeCx00LcV0ElVaUlrtBjI nCx30p/aJAciKvNgTcuxy+GHKXsDWxe6C3hWKB1m/G7vfgZu52cDIsR4oubadMbXVWPjBFcqdojvz qdhbZWFLkDckE4PGoPbrfiEJMZ4S2/fpe7b0G4M04iHKnnclE69eWPUHeZWtkIzU+pqnAkVc3csbb eZDOMT6uBvh5z9R1pkaH4aQDTZlEMXiTnHXkBRjl+0MBkVNXvIlLaWgr6CxU0Cj9JGNTMGnuzLlH9 2s1ssxWOPLu2RnH3yFTQ4JRfP65FCjQPh+xFTrM0ZtBdN1wkoxnKxpa9Y6xuKUn5pEpuRwZxDijGh J9X4wQ0g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sMnKb-0000000AAJs-00Rb; Thu, 27 Jun 2024 11:30:25 +0000 Received: from mgamail.intel.com ([198.175.65.10]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sMnGO-0000000A9RG-3wLE for linux-arm-kernel@lists.infradead.org; Thu, 27 Jun 2024 11:26:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1719487565; x=1751023565; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=baiPqPs3/Iq9ZzbQ7EO36Y/N0NPP8/8QjXTkbyX3mVw=; b=CmdbjQ+M1QofQM9K/bJAH4g+80lnRqF04k4JWxc5vURmyhPSNeoRZAcG IyBQvZ8BaVaGdS32f93GKHPuEEGevF76RiZGey7tzB0axBNIiqNV/6afs qotEj40g+e4SOacnEgWaRFiqN66fd6GhTtXNvgOSCY3bVEc6zWRKkYeFN AdChGWrJled0ZNrNxdmbEO1z747x9ZjisSbDPQ6r74OCWtlRkNAd/b5id TzxR1keNo+zSJXPcBA9g6GCISpfUpkcS/s8/VfbVnBCB8zUzuZl18TyNU 9FBHYap6JynlpEbpkn1KGYKnuS+38WVPWyv52HJIhxLS+EziaC78CQEpU Q==; X-CSE-ConnectionGUID: z0KJYGx5Q3yTuqjas0+kdg== X-CSE-MsgGUID: YHbyeBzDT/2EB5/Wqde2Kg== X-IronPort-AV: E=McAfee;i="6700,10204,11115"; a="34060934" X-IronPort-AV: E=Sophos;i="6.09,270,1716274800"; d="scan'208";a="34060934" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by orvoesa102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Jun 2024 04:26:02 -0700 X-CSE-ConnectionGUID: Uw9447FYSVqqXGdO8N1WRg== X-CSE-MsgGUID: 8Sy0b0wRTSuGWWkr005ZXA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.09,270,1716274800"; d="scan'208";a="45095644" Received: from turnipsi.fi.intel.com (HELO kekkonen.fi.intel.com) ([10.237.72.44]) by orviesa008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Jun 2024 04:25:59 -0700 Received: from kekkonen.localdomain (localhost [127.0.0.1]) by kekkonen.fi.intel.com (Postfix) with SMTP id 7D44C11F9C0; Thu, 27 Jun 2024 14:25:56 +0300 (EEST) Date: Thu, 27 Jun 2024 11:25:56 +0000 From: Sakari Ailus To: Hans Verkuil Cc: Alain Volmat , Hugues Fruchet , Mauro Carvalho Chehab , Maxime Coquelin , Alexandre Torgue , stable@vger.kernel.org, linux-media@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] media: stm32: dcmipp: correct error handling in dcmipp_create_subdevs Message-ID: References: <20240624084123.3009122-1-alain.volmat@foss.st.com> <8587b6cd-2d04-4a2e-b298-e57c792332f1@xs4all.nl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8587b6cd-2d04-4a2e-b298-e57c792332f1@xs4all.nl> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240627_042616_067434_1BD8C688 X-CRM114-Status: GOOD ( 23.47 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Hans, On Thu, Jun 27, 2024 at 01:17:55PM +0200, Hans Verkuil wrote: > On 24/06/2024 10:41, Alain Volmat wrote: > > Correct error handling within the dcmipp_create_subdevs by properly > > decrementing the i counter when releasing the subdeves. > > > > Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") > > Cc: stable@vger.kernel.org > > Signed-off-by: Alain Volmat > > --- > > drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > > index 4acc3b90d03a..4924ee36cfda 100644 > > --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > > +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c > > @@ -202,7 +202,7 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp) > > return 0; > > > > err_init_entity: > > - while (i > 0) > > + while (i-- > 0) > > dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]); > > return ret; > > } > > I accidentally merged this one, but this patch isn't right. > > After this change the [i - 1] indices should be changed to [i]. > If i == 1, then the while condition is true, but now i == 0 in the > actual statement, so you access out-of-bounds values. Right. I think the best way to fix this would be to just remove "- 1" inside the array indices. One could think this as a different bug but of course with an unpleasant side effect which you get after fixing the first bug. > > I decided to revert it, since it is better to just get stuck in the > while loop, then to crash. > > But a new patch is needed for this. -- Regards, Sakari Ailus