* [PATCH next] media: rockchip: rkcif: fix off by one bugs
@ 2025-11-19 8:09 Dan Carpenter
2025-11-26 20:27 ` Michael Riesch
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2025-11-19 8:09 UTC (permalink / raw)
To: Michael Riesch
Cc: Mehdi Djait, Mauro Carvalho Chehab, Heiko Stuebner, Sakari Ailus,
Hans Verkuil, Bryan O'Donoghue, linux-media, linux-arm-kernel,
linux-rockchip, linux-kernel, kernel-janitors
Change these comparisons from > vs >= to avoid accessing one element
beyond the end of the arrays.
Fixes: 1f2353f5a1af ("media: rockchip: rkcif: add support for rk3568 vicap mipi capture")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
.../media/platform/rockchip/rkcif/rkcif-capture-mipi.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c b/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
index 1b81bcc067ef..a933df682acc 100644
--- a/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
+++ b/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
@@ -489,8 +489,8 @@ static inline unsigned int rkcif_mipi_get_reg(struct rkcif_interface *interface,
block = interface->index - RKCIF_MIPI_BASE;
- if (WARN_ON_ONCE(block > RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
- WARN_ON_ONCE(index > RKCIF_MIPI_REGISTER_MAX))
+ if (WARN_ON_ONCE(block >= RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
+ WARN_ON_ONCE(index >= RKCIF_MIPI_REGISTER_MAX))
return RKCIF_REGISTER_NOTSUPPORTED;
offset = rkcif->match_data->mipi->blocks[block].offset;
@@ -510,9 +510,9 @@ static inline unsigned int rkcif_mipi_id_get_reg(struct rkcif_stream *stream,
block = stream->interface->index - RKCIF_MIPI_BASE;
id = stream->id;
- if (WARN_ON_ONCE(block > RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
- WARN_ON_ONCE(id > RKCIF_ID_MAX) ||
- WARN_ON_ONCE(index > RKCIF_MIPI_ID_REGISTER_MAX))
+ if (WARN_ON_ONCE(block >= RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
+ WARN_ON_ONCE(id >= RKCIF_ID_MAX) ||
+ WARN_ON_ONCE(index >= RKCIF_MIPI_ID_REGISTER_MAX))
return RKCIF_REGISTER_NOTSUPPORTED;
offset = rkcif->match_data->mipi->blocks[block].offset;
--
2.51.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH next] media: rockchip: rkcif: fix off by one bugs
2025-11-19 8:09 [PATCH next] media: rockchip: rkcif: fix off by one bugs Dan Carpenter
@ 2025-11-26 20:27 ` Michael Riesch
0 siblings, 0 replies; 2+ messages in thread
From: Michael Riesch @ 2025-11-26 20:27 UTC (permalink / raw)
To: Dan Carpenter
Cc: Mehdi Djait, Mauro Carvalho Chehab, Heiko Stuebner, Sakari Ailus,
Hans Verkuil, Bryan O'Donoghue, linux-media, linux-arm-kernel,
linux-rockchip, linux-kernel, kernel-janitors
Hi Dan,
Thanks for the patch, good catch!
On 11/19/25 09:09, Dan Carpenter wrote:
> Change these comparisons from > vs >= to avoid accessing one element
> beyond the end of the arrays.
>
> Fixes: 1f2353f5a1af ("media: rockchip: rkcif: add support for rk3568 vicap mipi capture")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Michael Riesch <michael.riesch@collabora.com>
Best regards,
Michael
> ---
> .../media/platform/rockchip/rkcif/rkcif-capture-mipi.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c b/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
> index 1b81bcc067ef..a933df682acc 100644
> --- a/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
> +++ b/drivers/media/platform/rockchip/rkcif/rkcif-capture-mipi.c
> @@ -489,8 +489,8 @@ static inline unsigned int rkcif_mipi_get_reg(struct rkcif_interface *interface,
>
> block = interface->index - RKCIF_MIPI_BASE;
>
> - if (WARN_ON_ONCE(block > RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
> - WARN_ON_ONCE(index > RKCIF_MIPI_REGISTER_MAX))
> + if (WARN_ON_ONCE(block >= RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
> + WARN_ON_ONCE(index >= RKCIF_MIPI_REGISTER_MAX))
> return RKCIF_REGISTER_NOTSUPPORTED;
>
> offset = rkcif->match_data->mipi->blocks[block].offset;
> @@ -510,9 +510,9 @@ static inline unsigned int rkcif_mipi_id_get_reg(struct rkcif_stream *stream,
> block = stream->interface->index - RKCIF_MIPI_BASE;
> id = stream->id;
>
> - if (WARN_ON_ONCE(block > RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
> - WARN_ON_ONCE(id > RKCIF_ID_MAX) ||
> - WARN_ON_ONCE(index > RKCIF_MIPI_ID_REGISTER_MAX))
> + if (WARN_ON_ONCE(block >= RKCIF_MIPI_MAX - RKCIF_MIPI_BASE) ||
> + WARN_ON_ONCE(id >= RKCIF_ID_MAX) ||
> + WARN_ON_ONCE(index >= RKCIF_MIPI_ID_REGISTER_MAX))
> return RKCIF_REGISTER_NOTSUPPORTED;
>
> offset = rkcif->match_data->mipi->blocks[block].offset;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-26 20:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-19 8:09 [PATCH next] media: rockchip: rkcif: fix off by one bugs Dan Carpenter
2025-11-26 20:27 ` Michael Riesch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).