From patchwork Sun Mar 29 20:59:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Longerbeam X-Patchwork-Id: 210381 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E8EDC2D0E5 for ; Sun, 29 Mar 2020 20:59:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DDCF420774 for ; Sun, 29 Mar 2020 20:59:36 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fBi3cQDe" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728865AbgC2U7g (ORCPT ); Sun, 29 Mar 2020 16:59:36 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:38757 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728475AbgC2U7g (ORCPT ); Sun, 29 Mar 2020 16:59:36 -0400 Received: by mail-pf1-f194.google.com with SMTP id c21so6917697pfo.5 for ; Sun, 29 Mar 2020 13:59:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=VRsfy162Q9sQSt9vxDFWl4mkzDdZOZ3jlrTSFnySsg4=; b=fBi3cQDeq52q6iWgGS4VQYpJ71IB4YFS89baf1tpQUr6MZCgchE3SpM1C+vZv37agi ZywVlQmAhA6AdA0TtLpbFhvMnLM+D8lyEf8DcxOZH9OgdYPAzSfQXV+BMrJp9LO9bpkx H9qFR4wx+wGAnaQYvSGRIDlJL7NdRydG05YltOqK4ulkQP5DvVysZ6apYOpd9nUadBDt lJzzR3b78r+6s9FmfYTycXCM5/JTmxEMiIMh8Vi5gFxxd5TEhhFuayFVhxAKo58paMSy 2z8W+aobJEDoVWkDtMR5+kcp7u6EvPTqKyvTUDIDAYeMywU1LgWh+qhwvdmvp0GDeTiP oYuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=VRsfy162Q9sQSt9vxDFWl4mkzDdZOZ3jlrTSFnySsg4=; b=SFgwH83X3pjJrAYZBV4xFaxbDKW3gYqoBzlz57q8U5XSc5GxCtmGO/4UHMRetUG59C HZTGa6CDPUtEFaOeuyIrDJkWTGUJI7APYmI2812JhryEzCXcYpds7xCrwFbYebAaw0do OpY2mjyHwlIHOH8QW+ozah3SkOpbul3YCHffJbtR0X/XDf+rg8ad62+9BiuKR/0AP8Uj WmeT7XUrZjQ6Ih3CcFWiHhVEZyH9wUhP2WkH+GU2n94KuuEejJAn/XTp753QKPnOYAYG Tj3g6jhOeCxpw0GuAstPMOPVDtSgo6uwGUZZayE+sXpXWTRsnwXVFmyl1vMcgVJViQyp m4cQ== X-Gm-Message-State: ANhLgQ0fVi4uZivKCuNkZzsbFUbZ0wRj5i9L2AF60KutTnaSm/zndUtP JRscPlcLnEA7kqXjs9fEYyK7QQ0oQO4= X-Google-Smtp-Source: ADFU+vufz5htmLIqjlys8SgfP/saofr+otpa+H0/WmlZbI90BOhmiscMxrWLN/xb5LmhNuN8ZQE8+w== X-Received: by 2002:a65:42c5:: with SMTP id l5mr9670198pgp.152.1585515574130; Sun, 29 Mar 2020 13:59:34 -0700 (PDT) Received: from mappy.nv.charter.com ([2600:6c4e:200:e053:a0c5:5fbc:c28e:f91f]) by smtp.gmail.com with ESMTPSA id 15sm8606049pfu.186.2020.03.29.13.59.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 29 Mar 2020 13:59:33 -0700 (PDT) From: Steve Longerbeam To: linux-media@vger.kernel.org Cc: Laurent Pinchart , Philipp Zabel , Rui Miguel Silva , Steve Longerbeam Subject: [PATCH v4 06/11] media: imx: utils: Make imx_media_pixfmt handle variable number of codes Date: Sun, 29 Mar 2020 13:59:15 -0700 Message-Id: <20200329205920.20118-7-slongerbeam@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200329205920.20118-1-slongerbeam@gmail.com> References: <20200329205920.20118-1-slongerbeam@gmail.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Laurent Pinchart The imx_media_pixfmt structures includes a codes member that stores media bus codes as a fixed array of 4 integers. The functions dealing with the imx_media_pixfmt structures assume that the array of codes is terminated by a 0 elements. This mechanism is fragile, as demonstrated by several instances of the structure contained 4 non-zero codes. Fix this by turning the array into a pointer, and providing an IMX_BUS_FMTS macro to initialize the codes member with a guaranteed 0 element at the end. Signed-off-by: Laurent Pinchart [Fix a NULL deref when derefencing a NULL cc->codes on return from several calls to imx_media_find_format()] Signed-off-by: Steve Longerbeam --- drivers/staging/media/imx/imx-media-capture.c | 4 +- drivers/staging/media/imx/imx-media-utils.c | 88 +++++++++++-------- drivers/staging/media/imx/imx-media.h | 2 +- 3 files changed, 53 insertions(+), 41 deletions(-) diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c index d60b49ec4fa4..650c53289f6b 100644 --- a/drivers/staging/media/imx/imx-media-capture.c +++ b/drivers/staging/media/imx/imx-media-capture.c @@ -95,7 +95,7 @@ static int capture_enum_framesizes(struct file *file, void *fh, if (!cc) return -EINVAL; - fse.code = cc->codes[0]; + fse.code = cc->codes ? cc->codes[0] : 0; ret = v4l2_subdev_call(priv->src_sd, pad, enum_frame_size, NULL, &fse); if (ret) @@ -137,7 +137,7 @@ static int capture_enum_frameintervals(struct file *file, void *fh, if (!cc) return -EINVAL; - fie.code = cc->codes[0]; + fie.code = cc->codes ? cc->codes[0] : 0; ret = v4l2_subdev_call(priv->src_sd, pad, enum_frame_interval, NULL, &fie); diff --git a/drivers/staging/media/imx/imx-media-utils.c b/drivers/staging/media/imx/imx-media-utils.c index 981a8b540a3c..da010eef0ae6 100644 --- a/drivers/staging/media/imx/imx-media-utils.c +++ b/drivers/staging/media/imx/imx-media-utils.c @@ -7,6 +7,12 @@ #include #include "imx-media.h" +#define IMX_BUS_FMTS(fmts...) \ + (const u32[]) { \ + fmts, \ + 0 \ + } + /* * List of supported pixel formats for the subdevs. */ @@ -14,18 +20,18 @@ static const struct imx_media_pixfmt pixel_formats[] = { /*** YUV formats start here ***/ { .fourcc = V4L2_PIX_FMT_UYVY, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_UYVY8_2X8, MEDIA_BUS_FMT_UYVY8_1X16 - }, + ), .cs = IPUV3_COLORSPACE_YUV, .bpp = 16, }, { .fourcc = V4L2_PIX_FMT_YUYV, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_YUYV8_2X8, MEDIA_BUS_FMT_YUYV8_1X16 - }, + ), .cs = IPUV3_COLORSPACE_YUV, .bpp = 16, }, { @@ -57,16 +63,16 @@ static const struct imx_media_pixfmt pixel_formats[] = { /*** RGB formats start here ***/ { .fourcc = V4L2_PIX_FMT_RGB565, - .codes = {MEDIA_BUS_FMT_RGB565_2X8_LE}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_RGB565_2X8_LE), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .cycles = 2, }, { .fourcc = V4L2_PIX_FMT_RGB24, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_RGB888_1X24, MEDIA_BUS_FMT_RGB888_2X12_LE - }, + ), .cs = IPUV3_COLORSPACE_RGB, .bpp = 24, }, { @@ -75,7 +81,7 @@ static const struct imx_media_pixfmt pixel_formats[] = { .bpp = 24, }, { .fourcc = V4L2_PIX_FMT_XRGB32, - .codes = {MEDIA_BUS_FMT_ARGB8888_1X32}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_ARGB8888_1X32), .cs = IPUV3_COLORSPACE_RGB, .bpp = 32, .ipufmt = true, @@ -95,91 +101,91 @@ static const struct imx_media_pixfmt pixel_formats[] = { /*** raw bayer and grayscale formats start here ***/ { .fourcc = V4L2_PIX_FMT_SBGGR8, - .codes = {MEDIA_BUS_FMT_SBGGR8_1X8}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_SBGGR8_1X8), .cs = IPUV3_COLORSPACE_RGB, .bpp = 8, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SGBRG8, - .codes = {MEDIA_BUS_FMT_SGBRG8_1X8}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_SGBRG8_1X8), .cs = IPUV3_COLORSPACE_RGB, .bpp = 8, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SGRBG8, - .codes = {MEDIA_BUS_FMT_SGRBG8_1X8}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_SGRBG8_1X8), .cs = IPUV3_COLORSPACE_RGB, .bpp = 8, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SRGGB8, - .codes = {MEDIA_BUS_FMT_SRGGB8_1X8}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_SRGGB8_1X8), .cs = IPUV3_COLORSPACE_RGB, .bpp = 8, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SBGGR16, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SBGGR12_1X12, MEDIA_BUS_FMT_SBGGR14_1X14, MEDIA_BUS_FMT_SBGGR16_1X16 - }, + ), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SGBRG16, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_SGBRG10_1X10, MEDIA_BUS_FMT_SGBRG12_1X12, MEDIA_BUS_FMT_SGBRG14_1X14, - MEDIA_BUS_FMT_SGBRG16_1X16, - }, + MEDIA_BUS_FMT_SGBRG16_1X16 + ), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SGRBG16, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SGRBG12_1X12, MEDIA_BUS_FMT_SGRBG14_1X14, - MEDIA_BUS_FMT_SGRBG16_1X16, - }, + MEDIA_BUS_FMT_SGRBG16_1X16 + ), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_SRGGB16, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_SRGGB10_1X10, MEDIA_BUS_FMT_SRGGB12_1X12, MEDIA_BUS_FMT_SRGGB14_1X14, - MEDIA_BUS_FMT_SRGGB16_1X16, - }, + MEDIA_BUS_FMT_SRGGB16_1X16 + ), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_GREY, - .codes = { + .codes = IMX_BUS_FMTS( MEDIA_BUS_FMT_Y8_1X8, MEDIA_BUS_FMT_Y10_1X10, - MEDIA_BUS_FMT_Y12_1X12, - }, + MEDIA_BUS_FMT_Y12_1X12 + ), .cs = IPUV3_COLORSPACE_RGB, .bpp = 8, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_Y10, - .codes = {MEDIA_BUS_FMT_Y10_1X10}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_Y10_1X10), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .bayer = true, }, { .fourcc = V4L2_PIX_FMT_Y12, - .codes = {MEDIA_BUS_FMT_Y12_1X12}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_Y12_1X12), .cs = IPUV3_COLORSPACE_RGB, .bpp = 16, .bayer = true, @@ -203,16 +209,16 @@ static const struct imx_media_pixfmt *find_format(u32 fourcc, CS_SEL_YUV : CS_SEL_RGB); if (!(fmt_cs_sel & cs_sel) || - (!allow_non_mbus && !fmt->codes[0])) + (!allow_non_mbus && !fmt->codes)) continue; if (fourcc && fmt->fourcc == fourcc) return fmt; - if (!code) + if (!code || !fmt->codes) continue; - for (j = 0; j < ARRAY_SIZE(fmt->codes) && fmt->codes[j]; j++) { + for (j = 0; fmt->codes[j]; j++) { if (code == fmt->codes[j]) return fmt; } @@ -237,7 +243,7 @@ static int enum_format(u32 *fourcc, u32 *code, u32 index, CS_SEL_YUV : CS_SEL_RGB); if (!(fmt_cs_sel & cs_sel) || - (!allow_non_mbus && !fmt->codes[0])) + (!allow_non_mbus && !fmt->codes)) continue; if (fourcc && index == 0) { @@ -250,7 +256,7 @@ static int enum_format(u32 *fourcc, u32 *code, u32 index, continue; } - for (j = 0; j < ARRAY_SIZE(fmt->codes) && fmt->codes[j]; j++) { + for (j = 0; fmt->codes[j]; j++) { if (index == 0) { *code = fmt->codes[j]; return 0; @@ -296,13 +302,13 @@ EXPORT_SYMBOL_GPL(imx_media_enum_mbus_format); static const struct imx_media_pixfmt ipu_formats[] = { { .fourcc = V4L2_PIX_FMT_YUV32, - .codes = {MEDIA_BUS_FMT_AYUV8_1X32}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_AYUV8_1X32), .cs = IPUV3_COLORSPACE_YUV, .bpp = 32, .ipufmt = true, }, { .fourcc = V4L2_PIX_FMT_XRGB32, - .codes = {MEDIA_BUS_FMT_ARGB8888_1X32}, + .codes = IMX_BUS_FMTS(MEDIA_BUS_FMT_ARGB8888_1X32), .cs = IPUV3_COLORSPACE_RGB, .bpp = 32, .ipufmt = true, @@ -327,7 +333,10 @@ imx_media_find_ipu_format(u32 code, enum codespace_sel cs_sel) (!accept_rgb && fmt->cs == IPUV3_COLORSPACE_RGB)) continue; - for (j = 0; j < ARRAY_SIZE(fmt->codes) && fmt->codes[j]; j++) { + if (!fmt->codes) + continue; + + for (j = 0; fmt->codes[j]; j++) { if (code == fmt->codes[j]) return fmt; } @@ -351,7 +360,10 @@ int imx_media_enum_ipu_format(u32 *code, u32 index, enum codespace_sel cs_sel) (!accept_rgb && fmt->cs == IPUV3_COLORSPACE_RGB)) continue; - for (j = 0; j < ARRAY_SIZE(fmt->codes) && fmt->codes[j]; j++) { + if (!fmt->codes) + continue; + + for (j = 0; fmt->codes[j]; j++) { if (index == 0) { *code = fmt->codes[j]; return 0; @@ -567,7 +579,7 @@ int imx_media_ipu_image_to_mbus_fmt(struct v4l2_mbus_framefmt *mbus, const struct imx_media_pixfmt *fmt; fmt = imx_media_find_format(image->pix.pixelformat, CS_SEL_ANY); - if (!fmt) + if (!fmt || !fmt->codes) return -EINVAL; memset(mbus, 0, sizeof(*mbus)); diff --git a/drivers/staging/media/imx/imx-media.h b/drivers/staging/media/imx/imx-media.h index 652673a703cd..917b4db02985 100644 --- a/drivers/staging/media/imx/imx-media.h +++ b/drivers/staging/media/imx/imx-media.h @@ -69,7 +69,7 @@ enum { struct imx_media_pixfmt { u32 fourcc; - u32 codes[4]; + const u32 *codes; int bpp; /* total bpp */ /* cycles per pixel for generic (bayer) formats for the parallel bus */ int cycles;