* [PATCH v3 0/6] media: Fix new smatch warnings
@ 2026-05-04 6:54 Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 5/6] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config Ricardo Ribalda
0 siblings, 2 replies; 4+ messages in thread
From: Ricardo Ribalda @ 2026-05-04 6:54 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Laurent Pinchart, Sakari Ailus,
Hans Verkuil, Nas Chung, Jackson Lee, Bingbu Cao, Tianshu Qiu,
Greg Kroah-Hartman, Keke Li, Yong Zhi, Jacopo Mondi
Cc: linux-media, linux-kernel, linux-staging, Mauro Carvalho Chehab,
Ricardo Ribalda, Hans Verkuil, stable
Current version of smatch triggers some warnings for the media tree.
Most of them are inoffensive, but we would like to have zero smatch
warnings.
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
drivers/media/v4l2-core/v4l2-dev.c:1036 __video_register_device() error: buffer overflow 'video_devices' 256 <= 288
drivers/media/v4l2-core/v4l2-dev.c:1043 __video_register_device() error: buffer overflow 'video_devices' 256 <= 288
drivers/media/v4l2-core/v4l2-dev.c:1101 __video_register_device() error: buffer overflow 'video_devices' 256 <= 288
drivers/media/platform/chips-media/wave5/wave5-vpuapi.c:588 wave5_vpu_dec_get_output_info() error: buffer overflow 'inst->frame_buf' 64 <= 127
drivers/staging/media/ipu3/ipu3-css-params.c:1792 imgu_css_cfg_acc_stripe() warn: 'acc->stripe.bds_out_stripes[0]->width - 2 * f' 4294967168 can't fit into 65535 'acc->stripe.bds_out_stripes[1]->offset'
drivers/media/i2c/adv7604.c:3672 adv76xx_probe() error: buffer overflow 'state->pads' 7 <= 4294967294
drivers/media/i2c/adv7604.c:3673 adv76xx_probe() error: buffer overflow 'state->pads' 7 <= u32max
drivers/media/i2c/mt9p031.c:799 mt9p031_s_ctrl() warn: assigning (-1952) to unsigned variable 'data'
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
Changes in v3:
- Rewrite mt9p031's bitmask to keep ~7
- Link to v2: https://lore.kernel.org/r/20260501-smatch-7-1-v2-0-a2fcfb2531ac@chromium.org
Changes in v2:
- Remove WARN_ON() in user triggerable checks.
- Add fixes for user triggerable errors.
- Remove pr_err in v4l-dev
- Link to v1: https://lore.kernel.org/r/20260428-smatch-7-1-v1-0-46890dffb611@chromium.org
---
Ricardo Ribalda (6):
media: v4l2-dev: Add range check for vdev->minor
media: i2c: mt9p031: Rewrite assignment to make smatch happy
media: i2c: adv7604: Add range checks for chip info
media: chips-media: wave5: Add range checks for dec_output_info
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
media: amlogic-c3: Add validations for ae and awb config
drivers/media/i2c/adv7604.c | 6 ++++++
drivers/media/i2c/mt9p031.c | 3 ++-
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
drivers/media/platform/chips-media/wave5/wave5-vpuapi.c | 11 +++++++++--
drivers/media/v4l2-core/v4l2-dev.c | 5 +++++
drivers/staging/media/ipu3/ipu3-css-params.c | 8 ++++++--
6 files changed, 32 insertions(+), 5 deletions(-)
---
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
change-id: 20260428-smatch-7-1-d969299dd3cf
Best regards,
--
Ricardo Ribalda <ribalda@chromium.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v3 5/6] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
2026-05-04 6:54 [PATCH v3 0/6] media: Fix new smatch warnings Ricardo Ribalda
@ 2026-05-04 6:54 ` Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config Ricardo Ribalda
1 sibling, 0 replies; 4+ messages in thread
From: Ricardo Ribalda @ 2026-05-04 6:54 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Laurent Pinchart, Sakari Ailus,
Hans Verkuil, Nas Chung, Jackson Lee, Bingbu Cao, Tianshu Qiu,
Greg Kroah-Hartman, Keke Li, Yong Zhi, Jacopo Mondi
Cc: linux-media, linux-kernel, linux-staging, Mauro Carvalho Chehab,
Ricardo Ribalda, stable
If the driver's stripe information is invalid it can result in an integer
overflow. Add a range check with a WARN_ON to expose this kind of
error.
This patch fixes the following smatch error:
drivers/staging/media/ipu3/ipu3-css-params.c:1792 imgu_css_cfg_acc_stripe() warn: 'acc->stripe.bds_out_stripes[0]->width - 2 * f' 4294967168 can't fit into 65535 'acc->stripe.bds_out_stripes[1]->offset'
Cc: stable@vger.kernel.org
Fixes: e11110a5b744 ("media: staging/intel-ipu3: css: Compute and program ccs")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
drivers/staging/media/ipu3/ipu3-css-params.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/media/ipu3/ipu3-css-params.c b/drivers/staging/media/ipu3/ipu3-css-params.c
index 2c48d57a3180..92cce31e35c5 100644
--- a/drivers/staging/media/ipu3/ipu3-css-params.c
+++ b/drivers/staging/media/ipu3/ipu3-css-params.c
@@ -1770,6 +1770,8 @@ static int imgu_css_cfg_acc_stripe(struct imgu_css *css, unsigned int pipe,
acc->stripe.bds_out_stripes[0].width =
ALIGN(css_pipe->rect[IPU3_CSS_RECT_BDS].width, f);
} else {
+ u32 offset;
+
/* Image processing is divided into two stripes */
acc->stripe.bds_out_stripes[0].width =
acc->stripe.bds_out_stripes[1].width =
@@ -1788,8 +1790,10 @@ static int imgu_css_cfg_acc_stripe(struct imgu_css *css, unsigned int pipe,
acc->stripe.bds_out_stripes[1].width += f;
}
/* Overlap between stripes is IPU3_UAPI_ISP_VEC_ELEMS * 4 */
- acc->stripe.bds_out_stripes[1].offset =
- acc->stripe.bds_out_stripes[0].width - 2 * f;
+ offset = acc->stripe.bds_out_stripes[0].width - 2 * f;
+ if (offset > 65535)
+ return -EINVAL;
+ acc->stripe.bds_out_stripes[1].offset = offset;
}
acc->stripe.effective_stripes[0].height =
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config
2026-05-04 6:54 [PATCH v3 0/6] media: Fix new smatch warnings Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 5/6] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Ricardo Ribalda
@ 2026-05-04 6:54 ` Ricardo Ribalda
2026-05-04 7:19 ` Jacopo Mondi
1 sibling, 1 reply; 4+ messages in thread
From: Ricardo Ribalda @ 2026-05-04 6:54 UTC (permalink / raw)
To: Mauro Carvalho Chehab, Laurent Pinchart, Sakari Ailus,
Hans Verkuil, Nas Chung, Jackson Lee, Bingbu Cao, Tianshu Qiu,
Greg Kroah-Hartman, Keke Li, Yong Zhi, Jacopo Mondi
Cc: linux-media, linux-kernel, linux-staging, Mauro Carvalho Chehab,
Ricardo Ribalda, stable
Avoid invalid memory access if the zones_num is bigger than
zone_weight.
This patch fixes the following smatch errors:
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
Cc: stable@vger.kernel.org
Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index 6f9ca7a7dd88..aec3eed0e443 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
+ if (zones_num > C3_ISP_AWB_MAX_ZONES)
+ zones_num = C3_ISP_AWB_MAX_ZONES;
/* Need to write 8 weights at once */
for (i = 0; i < zones_num / 8; i++) {
@@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
+ if (zones_num > C3_ISP_AE_MAX_ZONES)
+ zones_num = C3_ISP_AE_MAX_ZONES;
/* Need to write 8 weights at once */
for (i = 0; i < zones_num / 8; i++) {
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config
2026-05-04 6:54 ` [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config Ricardo Ribalda
@ 2026-05-04 7:19 ` Jacopo Mondi
0 siblings, 0 replies; 4+ messages in thread
From: Jacopo Mondi @ 2026-05-04 7:19 UTC (permalink / raw)
To: Ricardo Ribalda
Cc: Mauro Carvalho Chehab, Laurent Pinchart, Sakari Ailus,
Hans Verkuil, Nas Chung, Jackson Lee, Bingbu Cao, Tianshu Qiu,
Greg Kroah-Hartman, Keke Li, Yong Zhi, Jacopo Mondi, linux-media,
linux-kernel, linux-staging, Mauro Carvalho Chehab, stable
Hi Ricardo
On Mon, May 04, 2026 at 06:54:09AM +0000, Ricardo Ribalda wrote:
> Avoid invalid memory access if the zones_num is bigger than
> zone_weight.
>
> This patch fixes the following smatch errors:
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
>
> Cc: stable@vger.kernel.org
> Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> index 6f9ca7a7dd88..aec3eed0e443 100644
> --- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> +++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> @@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
> c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
>
> zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> + if (zones_num > C3_ISP_AWB_MAX_ZONES)
> + zones_num = C3_ISP_AWB_MAX_ZONES;
Or
zones_num = min(cfg->horiz_zones_num * cfg->vert_zones_num,
C3_ISP_AWB_MAX_ZONES);
Whatever you prefer:
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
>
> /* Need to write 8 weights at once */
> for (i = 0; i < zones_num / 8; i++) {
> @@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
> c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
>
> zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> + if (zones_num > C3_ISP_AE_MAX_ZONES)
> + zones_num = C3_ISP_AE_MAX_ZONES;
>
> /* Need to write 8 weights at once */
> for (i = 0; i < zones_num / 8; i++) {
>
> --
> 2.54.0.545.g6539524ca2-goog
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-05-04 7:19 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-04 6:54 [PATCH v3 0/6] media: Fix new smatch warnings Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 5/6] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Ricardo Ribalda
2026-05-04 6:54 ` [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config Ricardo Ribalda
2026-05-04 7:19 ` Jacopo Mondi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox