From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1901C433F5 for ; Wed, 30 Mar 2022 12:08:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242361AbiC3MJz (ORCPT ); Wed, 30 Mar 2022 08:09:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344975AbiC3Lxu (ORCPT ); Wed, 30 Mar 2022 07:53:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64444275470; Wed, 30 Mar 2022 04:50:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 46B6D615E2; Wed, 30 Mar 2022 11:50:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B87FDC36AFA; Wed, 30 Mar 2022 11:50:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648641009; bh=1mzmburc3X+szuNAEo1tXUhYMeph1aGhucbEOTahC2s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K6nW+4kiD2R06IJnVsA7Ajrsn3U2ZFYK8wzrrcLbU9naEYyPE/5gdO9TdBa1wHgSs iy8Djky9FYOGEqpEhf2X7XeHFY+c40HbnIo5nAhM53KJTG+Sk/N636qhfsSvT+W8/E wwd34Dl2PzRrGi6+GNU7xW4an/ptxy5tkRkddRdXLNLG7pXgDu45XsggObx0gBgofs XaIrAdu8IFp7iKAb+x8ux711bNmggdf35eyUH/xQqejjjBqpbnryII3DfN3xfCJjqA SRpVM3GahvKdqyRb1SoSwqYAtlvyDxU2Mvst3vfglVeJMA8FyA7/8JzWSDKJGarDkP ekBkCbx6G5qdA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Corentin Labbe , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin , gregkh@linuxfoundation.org, linux-media@vger.kernel.org, devel@driverdev.osuosl.org Subject: [PATCH AUTOSEL 5.15 02/50] media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com Date: Wed, 30 Mar 2022 07:49:16 -0400 Message-Id: <20220330115005.1671090-2-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220330115005.1671090-1-sashal@kernel.org> References: <20220330115005.1671090-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Corentin Labbe [ Upstream commit e3b86f4e558cea9eed71d894df2f19b10d60a207 ] On the case tmp_dcim=1, the index of buffer is miscalculated. This generate a NULL pointer dereference later. So let's fix the calcul and add a check to prevent this to reappear. Signed-off-by: Corentin Labbe Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/staging/media/zoran/zoran_device.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/zoran/zoran_device.c b/drivers/staging/media/zoran/zoran_device.c index 5b12a730a229..fb1f0465ca87 100644 --- a/drivers/staging/media/zoran/zoran_device.c +++ b/drivers/staging/media/zoran/zoran_device.c @@ -814,7 +814,7 @@ static void zoran_reap_stat_com(struct zoran *zr) if (zr->jpg_settings.tmp_dcm == 1) i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM; else - i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1; + i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2; stat_com = le32_to_cpu(zr->stat_com[i]); if ((stat_com & 1) == 0) { @@ -826,6 +826,11 @@ static void zoran_reap_stat_com(struct zoran *zr) size = (stat_com & GENMASK(22, 1)) >> 1; buf = zr->inuse[i]; + if (!buf) { + spin_unlock_irqrestore(&zr->queued_bufs_lock, flags); + pci_err(zr->pci_dev, "No buffer at slot %d\n", i); + return; + } buf->vbuf.vb2_buf.timestamp = ktime_get_ns(); if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) { -- 2.34.1