From patchwork Tue Jul 25 20:40:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?TsOtY29sYXMgRi4gUi4gQS4gUHJhZG8=?= X-Patchwork-Id: 125809 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:a985:0:b0:3e4:2afc:c1 with SMTP id t5csp15623vqo; Tue, 25 Jul 2023 14:17:08 -0700 (PDT) X-Google-Smtp-Source: APBJJlHjaAeajqJ5NJ2oUYLPozfm2i6fLqG8+PlEzVAW2oTJL2vqgGMnKEvFDdrEcUo7Uf/QA4nq X-Received: by 2002:a05:6a00:3909:b0:682:4c1c:a0fc with SMTP id fh9-20020a056a00390900b006824c1ca0fcmr441178pfb.19.1690319828158; Tue, 25 Jul 2023 14:17:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1690319828; cv=none; d=google.com; s=arc-20160816; b=Pq8cHXXXsYTV7GE0fN4A4ZVjV1MTLElZGwfIX2ux/LiMgygdX0ZzQhyKFxvJNUQfWH wBXGHHdL0h4j+wBNVvOLU4vqB4YvezHds5H2lxiq3uMItjgdA5J53iU8fFGOuFmC+qhd FPdYVZRsrqDygwT2/9iOlp53sihoihcTiwfHCpxQIVeHKN13YshQx2g8ymr3sNCuWhHN uqP47uyKxaMeR+RhkNE6QDZP78Y/sLcjeAONwXGmcGD5MZU/fROXWMyTE9XXLubMbOaP mlbIAQQTbSOpcmzgy9sgrVoSWC0Bczg5ZRuB1oooiZrnLrTNX/EcK0Q0g0WNLgfbFfNO MUxA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=KeHiYwDUMYfCKwxyU7pvurAIeuJQCvlwl13Xex3hWWI=; fh=avi8W7X79y1W8coO2PeC6qovCBw8g7f9CpoyH9kOFQ8=; b=TJfLzRHVs3BD1JxIHbDJz7pPuDHHLXr6L5X1VHQWWoteBwYJq98bi76i8XDP27ub2o Z4oMoFT9otg/1+4eU+yqH5/Zq/169aF6O1DSqMkBoYqZQ/HbfsFIsV54xAnUh43QsVVj KDv1okliB5mdFa3yjaNnTEUH1/bY94McVMBoq3D7LIlnUo2gZHiZ5AHTngnsOXBbeBO+ Ub2M/hYMFScrndA2Ox6Ii4WPS5fHZdl5LIxSaT0nQ40Y3DmeHJULFsMRhFv43mJhmvnj W2c26gwiUyc5Bf/Az05GhsUGvK+pMaP+naGZL4N/AeTnnbfUD2vJWtHG0M5N5/KPClpK y4Cw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@collabora.com header.s=mail header.b=Cx3GrVj1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=collabora.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h11-20020a63574b000000b00545a181d157si12682207pgm.51.2023.07.25.14.16.52; Tue, 25 Jul 2023 14:17:08 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@collabora.com header.s=mail header.b=Cx3GrVj1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=collabora.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231265AbjGYUlT (ORCPT + 99 others); Tue, 25 Jul 2023 16:41:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39176 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229896AbjGYUlO (ORCPT ); Tue, 25 Jul 2023 16:41:14 -0400 Received: from madras.collabora.co.uk (madras.collabora.co.uk [46.235.227.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A7A32118; Tue, 25 Jul 2023 13:40:54 -0700 (PDT) Received: from notapiano.myfiosgateway.com (zone.collabora.co.uk [167.235.23.81]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nfraprado) by madras.collabora.co.uk (Postfix) with ESMTPSA id 83EEB66003AA; Tue, 25 Jul 2023 21:40:51 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1690317653; bh=iMBQ+s+wbpCm8QUbxfi+mfkOxoIlRyEKgUUo7g7/1i0=; h=From:To:Cc:Subject:Date:From; b=Cx3GrVj1e1Yf45KTfHj6nGdGPQwkfC3ZGbMopZLX6d+wmXEe1nUa0jxLgNGbS5soN mufw/QA1mUdaewY1A0DPSBvDbuMK9TGGIdm2CTUcuJckYGHZWDQtal+lspXcc74Kfz F6wSs1M7e5tKpWvgQF+3x/qEwvomKgU3uslCF5WAYcgsnxKSmp1PfIWNDYmXQrp66h CkvL7tDh0R5JwSBqKu+cs5nL6YoaZ/n9msdvVuV0vG5+ANjmlGSSqpMpdGwS1n8ia5 AjUGAhWHbAN1+KjI70aaiaChZPlJwLT5K0nLsLIkBaL3rCuTSOqR5RU3kSsUTT+hfY BR8+sbXOms5HQ== From: =?utf-8?b?TsOtY29sYXMgRi4gUi4gQS4gUHJhZG8=?= To: Hans Verkuil Cc: kernel@collabora.com, AngeloGioacchino Del Regno , =?utf-8?b?TsOtY29sYXMgRi4gUi4gQS4gUHJhZG8=?= , Andrew-CT Chen , Matthias Brugger , Mauro Carvalho Chehab , Tiffany Lin , Yunfei Dong , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linux-mediatek@lists.infradead.org Subject: [PATCH] media: mediatek: vcodec: Consider vdecsys presence in reg range check Date: Tue, 25 Jul 2023 16:40:39 -0400 Message-ID: <20230725204043.569799-1-nfraprado@collabora.com> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1772428803954781951 X-GMAIL-MSGID: 1772428803954781951 Commit fe8a33978383 ("media: mediatek: vcodec: Read HW active status from syscon") allowed the driver to read the VDEC_SYS io space from a syscon instead of from the reg property when reg-names are supplied. However as part of that change, a smatch warning was introduced: drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c:142 mtk_vcodec_get_reg_bases() error: buffer overflow 'mtk_dec_reg_names' 11 <= 11 With a correct Devicetree, that is, one that follows the dt-binding, it wouldn't be possible to trigger such a buffer overflow. Even so, update the range validation of the reg property, so that the smatch warning is fixed and if an incorrect Devicetree is ever supplied the code errors out instead of causing memory corruption. Reported-by: Hans Verkuil Closes: https://lore.kernel.org/all/b5fd2dff-14a5-3ad8-9698-d1a50f4516fa@xs4all.nl Fixes: fe8a33978383 ("media: mediatek: vcodec: Read HW active status from syscon") Signed-off-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno --- drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c index 742b6903d030..cd62b3f68072 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c @@ -124,7 +124,8 @@ static int mtk_vcodec_get_reg_bases(struct mtk_vcodec_dev *dev) /* Sizeof(u32) * 4 bytes for each register base. */ reg_num = of_property_count_elems_of_size(pdev->dev.of_node, "reg", sizeof(u32) * 4); - if (reg_num <= 0 || reg_num > NUM_MAX_VDEC_REG_BASE) { + if (reg_num <= 0 || reg_num > NUM_MAX_VDEC_REG_BASE || + (!has_vdecsys_reg && reg_num > NUM_MAX_VDEC_REG_BASE - 1)) { dev_err(&pdev->dev, "Invalid register property size: %d\n", reg_num); return -EINVAL; }