iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: mediatek: vcodec: Consider vdecsys presence in reg range check

Browse Source 
Commit fe8a339783 ("media: mediatek: vcodec: Read HW active status
from syscon") allowed the driver to read the VDEC_SYS io space from a
syscon instead of from the reg property when reg-names are supplied.
However as part of that change, a smatch warning was introduced:

drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c:142 mtk_vcodec_get_reg_bases() error: buffer overflow 'mtk_dec_reg_names' 11 <= 11

With a correct Devicetree, that is, one that follows the dt-binding, it
wouldn't be possible to trigger such a buffer overflow. Even so, update
the range validation of the reg property, so that the smatch warning is
fixed and if an incorrect Devicetree is ever supplied the code errors
out instead of causing memory corruption.

Reported-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Closes: https://lore.kernel.org/all/b5fd2dff-14a5-3ad8-9698-d1a50f4516fa@xs4all.nl
Fixes: fe8a339783 ("media: mediatek: vcodec: Read HW active status from syscon")
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
This commit is contained in:
Nícolas F. R. A. Prado 2023-07-26 12:57:39 -04:00 committed by Hans Verkuil
parent 7baeedbe2b
commit dd61c2a380
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c
View File

@ -96,6 +96,7 @@ static int mtk_vcodec_get_reg_bases(struct mtk_vcodec_dev *dev)
int reg_num, i;
struct resource *res;
bool has_vdecsys_reg;
int num_max_vdec_regs;
static const char * const mtk_dec_reg_names[] = {
"misc",
"ld",
@ -122,10 +123,13 @@ static int mtk_vcodec_get_reg_bases(struct mtk_vcodec_dev *dev)
else
has_vdecsys_reg = true;
num_max_vdec_regs = has_vdecsys_reg ? NUM_MAX_VDEC_REG_BASE :
ARRAY_SIZE(mtk_dec_reg_names);
/* Sizeof(u32) * 4 bytes for each register base. */
reg_num = of_property_count_elems_of_size(pdev->dev.of_node, "reg",
sizeof(u32) * 4);
if (reg_num <= 0 || reg_num > NUM_MAX_VDEC_REG_BASE) {
if (reg_num <= 0 || reg_num > num_max_vdec_regs) {
dev_err(&pdev->dev, "Invalid register property size: %d\n", reg_num);
return -EINVAL;
}