diff mbox series

[5.10,527/717] media: ipu3-cio2: Validate mbus format in setting subdev format

Message ID 20201228125046.214023397@linuxfoundation.org
State New
Headers show
Series None | expand

Commit Message

Greg KH Dec. 28, 2020, 12:48 p.m. UTC 
From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

Validate media bus code, width and height when setting the subdev format.

This effectively reworks how setting subdev format is implemented in the
driver.

Fixes: c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: stable@vger.kernel.org # v4.16 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/intel/ipu3/ipu3-cio2.c |   29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

Comments

Pavel Machek Dec. 30, 2020, 12:25 p.m. UTC | #1 
Hi!

> commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

> 

> Validate media bus code, width and height when setting the subdev format.

> 

> This effectively reworks how setting subdev format is implemented in the

> driver.


Something is wrong here:

> +	fmt->format.code = formats[0].mbus_code;

> +	for (i = 0; i < ARRAY_SIZE(formats); i++) {

> +		if (formats[i].mbus_code == fmt->format.code) {

> +			fmt->format.code = mbus_code;

> +			break;

> +		}


This does not make sense. Loop will always exit during the first
iteration, making the whole loop crazy/redundant.

Best regards,
								Pavel

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Andy Shevchenko Dec. 30, 2020, 12:32 p.m. UTC | #2 
On Wed, Dec 30, 2020 at 2:25 PM Pavel Machek <pavel@denx.de> wrote:

> > commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

> >

> > Validate media bus code, width and height when setting the subdev format.

> >

> > This effectively reworks how setting subdev format is implemented in the

> > driver.

>

> Something is wrong here:

>

> > +     fmt->format.code = formats[0].mbus_code;

> > +     for (i = 0; i < ARRAY_SIZE(formats); i++) {


Looks like 'i = 1' should be...

> > +             if (formats[i].mbus_code == fmt->format.code) {

> > +                     fmt->format.code = mbus_code;

> > +                     break;

> > +             }

>

> This does not make sense. Loop will always exit during the first

> iteration, making the whole loop crazy/redundant.




-- 
With Best Regards,
Andy Shevchenko
Laurent Pinchart Dec. 30, 2020, 12:44 p.m. UTC | #3 
On Wed, Dec 30, 2020 at 02:32:46PM +0200, Andy Shevchenko wrote:
> On Wed, Dec 30, 2020 at 2:25 PM Pavel Machek wrote:

> 

> > > commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

> > >

> > > Validate media bus code, width and height when setting the subdev format.

> > >

> > > This effectively reworks how setting subdev format is implemented in the

> > > driver.

> >

> > Something is wrong here:

> >

> > > +     fmt->format.code = formats[0].mbus_code;

> > > +     for (i = 0; i < ARRAY_SIZE(formats); i++) {

> 

> Looks like 'i = 1' should be...

> 

> > > +             if (formats[i].mbus_code == fmt->format.code) {


More likely

			if (formats[i].mbus_code == mbus_code) {

I think.

Pavel, would you like to submit a patch ?

> > > +                     fmt->format.code = mbus_code;

> > > +                     break;

> > > +             }

> >

> > This does not make sense. Loop will always exit during the first

> > iteration, making the whole loop crazy/redundant.


-- 
Regards,

Laurent Pinchart
Pavel Machek Dec. 30, 2020, 12:56 p.m. UTC | #4 
On Wed 2020-12-30 14:44:41, Laurent Pinchart wrote:
> On Wed, Dec 30, 2020 at 02:32:46PM +0200, Andy Shevchenko wrote:

> > On Wed, Dec 30, 2020 at 2:25 PM Pavel Machek wrote:

> > 

> > > > commit a86cf9b29e8b12811cf53c4970eefe0c1d290476 upstream.

> > > >

> > > > Validate media bus code, width and height when setting the subdev format.

> > > >

> > > > This effectively reworks how setting subdev format is implemented in the

> > > > driver.

> > >

> > > Something is wrong here:

> > >

> > > > +     fmt->format.code = formats[0].mbus_code;

> > > > +     for (i = 0; i < ARRAY_SIZE(formats); i++) {

> > 

> > Looks like 'i = 1' should be...

> > 

> > > > +             if (formats[i].mbus_code == fmt->format.code) {

> 

> More likely

> 

> 			if (formats[i].mbus_code == mbus_code) {

> 

> I think.


That looks reasonable, but I don't have hardware to test.

> Pavel, would you like to submit a patch ?


Done, should be in your inbox.

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
diff mbox series

Patch

--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -1258,6 +1258,9 @@  static int cio2_subdev_set_fmt(struct v4
 			       struct v4l2_subdev_format *fmt)
 {
 	struct cio2_queue *q = container_of(sd, struct cio2_queue, subdev);
+	struct v4l2_mbus_framefmt *mbus;
+	u32 mbus_code = fmt->format.code;
+	unsigned int i;
 
 	/*
 	 * Only allow setting sink pad format;
@@ -1266,18 +1269,26 @@  static int cio2_subdev_set_fmt(struct v4
 	if (fmt->pad == CIO2_PAD_SOURCE)
 		return cio2_subdev_get_fmt(sd, cfg, fmt);
 
-	mutex_lock(&q->subdev_lock);
+	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY)
+		mbus = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+	else
+		mbus = &q->subdev_fmt;
+
+	fmt->format.code = formats[0].mbus_code;
 
-	if (fmt->which == V4L2_SUBDEV_FORMAT_TRY) {
-		*v4l2_subdev_get_try_format(sd, cfg, fmt->pad) = fmt->format;
-	} else {
-		/* It's the sink, allow changing frame size */
-		q->subdev_fmt.width = fmt->format.width;
-		q->subdev_fmt.height = fmt->format.height;
-		q->subdev_fmt.code = fmt->format.code;
-		fmt->format = q->subdev_fmt;
+	for (i = 0; i < ARRAY_SIZE(formats); i++) {
+		if (formats[i].mbus_code == fmt->format.code) {
+			fmt->format.code = mbus_code;
+			break;
+		}
 	}
 
+	fmt->format.width = min_t(u32, fmt->format.width, CIO2_IMAGE_MAX_WIDTH);
+	fmt->format.height = min_t(u32, fmt->format.height,
+				   CIO2_IMAGE_MAX_LENGTH);
+
+	mutex_lock(&q->subdev_lock);
+	*mbus = fmt->format;
 	mutex_unlock(&q->subdev_lock);
 
 	return 0;