From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
To: Ricardo Ribalda <ribalda@chromium.org>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>,
Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Hans Verkuil <hverkuil@kernel.org>,
Nas Chung <nas.chung@chipsnmedia.com>,
Jackson Lee <jackson.lee@chipsnmedia.com>,
Bingbu Cao <bingbu.cao@intel.com>,
Tianshu Qiu <tian.shu.qiu@intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Keke Li <keke.li@amlogic.com>, Yong Zhi <yong.zhi@intel.com>,
Jacopo Mondi <jacopo.mondi@ideasonboard.com>,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-staging@lists.linux.dev,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
stable@vger.kernel.org
Subject: Re: [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config
Date: Mon, 4 May 2026 09:19:30 +0200 [thread overview]
Message-ID: <afhH8Fq_7bIy3Lv3@zed> (raw)
In-Reply-To: <20260504-smatch-7-1-v3-6-fda125c30058@chromium.org>
Hi Ricardo
On Mon, May 04, 2026 at 06:54:09AM +0000, Ricardo Ribalda wrote:
> Avoid invalid memory access if the zones_num is bigger than
> zone_weight.
>
> This patch fixes the following smatch errors:
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
>
> Cc: stable@vger.kernel.org
> Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> index 6f9ca7a7dd88..aec3eed0e443 100644
> --- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> +++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> @@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
> c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
>
> zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> + if (zones_num > C3_ISP_AWB_MAX_ZONES)
> + zones_num = C3_ISP_AWB_MAX_ZONES;
Or
zones_num = min(cfg->horiz_zones_num * cfg->vert_zones_num,
C3_ISP_AWB_MAX_ZONES);
Whatever you prefer:
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
>
> /* Need to write 8 weights at once */
> for (i = 0; i < zones_num / 8; i++) {
> @@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
> c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
>
> zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> + if (zones_num > C3_ISP_AE_MAX_ZONES)
> + zones_num = C3_ISP_AE_MAX_ZONES;
>
> /* Need to write 8 weights at once */
> for (i = 0; i < zones_num / 8; i++) {
>
> --
> 2.54.0.545.g6539524ca2-goog
>
prev parent reply other threads:[~2026-05-04 7:19 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-04 6:54 [PATCH v3 0/6] media: Fix new smatch warnings Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 5/6] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config Ricardo Ribalda
2026-05-04 7:19 ` Jacopo Mondi [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=afhH8Fq_7bIy3Lv3@zed \
--to=jacopo.mondi@ideasonboard.com \
--cc=bingbu.cao@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hverkuil@kernel.org \
--cc=jackson.lee@chipsnmedia.com \
--cc=keke.li@amlogic.com \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=mchehab+samsung@kernel.org \
--cc=mchehab@kernel.org \
--cc=nas.chung@chipsnmedia.com \
--cc=ribalda@chromium.org \
--cc=sakari.ailus@linux.intel.com \
--cc=stable@vger.kernel.org \
--cc=tian.shu.qiu@intel.com \
--cc=yong.zhi@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox