* [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
@ 2026-08-21 21:27 David Carlier
0 siblings, 0 replies; 3+ messages in thread
From: David Carlier @ 2026-08-21 21:27 UTC (permalink / raw)
To: Keke Li; +Cc: Jacopo Mondi, Mauro Carvalho Chehab, linux-media, linux-kernel
The AWB, AE and AF coordinate loops bound themselves by
max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
taken verbatim from userspace, so the bound reaches 256 while the
coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
placed last in a full payload reads 474 bytes past the parameters
buffer.
Clamp the point count to the array size, as the zone weight loops
already do.
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index ae0777a20bda..f2396e2c6640 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AWB_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
@@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AE_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
@@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AF_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
@ 2026-08-21 21:27 David Carlier
0 siblings, 0 replies; 3+ messages in thread
From: David Carlier @ 2026-08-21 21:27 UTC (permalink / raw)
To: Keke Li; +Cc: Jacopo Mondi, Mauro Carvalho Chehab, linux-media, linux-kernel
The AWB, AE and AF coordinate loops bound themselves by
max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
taken verbatim from userspace, so the bound reaches 256 while the
coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
placed last in a full payload reads 474 bytes past the parameters
buffer.
Clamp the point count to the array size, as the zone weight loops
already do.
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index ae0777a20bda..f2396e2c6640 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AWB_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
@@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AE_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
@@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AF_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
@ 2026-08-21 21:28 David Carlier
0 siblings, 0 replies; 3+ messages in thread
From: David Carlier @ 2026-08-21 21:28 UTC (permalink / raw)
To: Keke Li; +Cc: Jacopo Mondi, linux-media, linux-kernel, David Carlier, stable
The AWB, AE and AF coordinate loops bound themselves by
max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
taken verbatim from userspace, so the bound reaches 256 while the
coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
placed last in a full payload reads 474 bytes past the parameters
buffer.
Clamp the point count to the array size, as the zone weight loops
already do.
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index ae0777a20bda..f2396e2c6640 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AWB_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
@@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AE_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
@@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AF_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-21 21:28 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-21 21:27 [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates David Carlier
-- strict thread matches above, loose matches on Subject: below --
2026-08-21 21:27 David Carlier
2026-08-21 21:28 David Carlier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox