On Thu May 7 20:58:10 2026 +0000, Ricardo Ribalda wrote:
> If the driver's stripe information is invalid it can result in an integer
> underflow. Add a range check to avoid this kind of error.
>
> This patch fixes the following smatch error:
> drivers/staging/media/ipu3/ipu3-css-params.c:1792 imgu_css_cfg_acc_stripe()
> warn: 'acc->stripe.bds_out_stripes[0]->width - 2 * f' 4294967168 can't fit
> into 65535 'acc->stripe.bds_out_stripes[1]->offset'
>
> Cc: [email protected]
> Fixes: e11110a5b744 ("media: staging/intel-ipu3: css: Compute and program
> ccs")
> Signed-off-by: Ricardo Ribalda <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/staging/media/ipu3/ipu3-css-params.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
---
diff --git a/drivers/staging/media/ipu3/ipu3-css-params.c
b/drivers/staging/media/ipu3/ipu3-css-params.c
index 2c48d57a3180..92cce31e35c5 100644
--- a/drivers/staging/media/ipu3/ipu3-css-params.c
+++ b/drivers/staging/media/ipu3/ipu3-css-params.c
@@ -1770,6 +1770,8 @@ static int imgu_css_cfg_acc_stripe(struct imgu_css *css,
unsigned int pipe,
acc->stripe.bds_out_stripes[0].width =
ALIGN(css_pipe->rect[IPU3_CSS_RECT_BDS].width, f);
} else {
+ u32 offset;
+
/* Image processing is divided into two stripes */
acc->stripe.bds_out_stripes[0].width =
acc->stripe.bds_out_stripes[1].width =
@@ -1788,8 +1790,10 @@ static int imgu_css_cfg_acc_stripe(struct imgu_css *css,
unsigned int pipe,
acc->stripe.bds_out_stripes[1].width += f;
}
/* Overlap between stripes is IPU3_UAPI_ISP_VEC_ELEMS * 4 */
- acc->stripe.bds_out_stripes[1].offset =
- acc->stripe.bds_out_stripes[0].width - 2 * f;
+ offset = acc->stripe.bds_out_stripes[0].width - 2 * f;
+ if (offset > 65535)
+ return -EINVAL;
+ acc->stripe.bds_out_stripes[1].offset = offset;
}
acc->stripe.effective_stripes[0].height =
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
