From patchwork Sat Feb 6 07:38:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 378420 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.0 required=3.0 tests=BAYES_00, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B749C433DB for ; Sat, 6 Feb 2021 08:56:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1A63764E0A for ; Sat, 6 Feb 2021 08:56:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229539AbhBFI4I (ORCPT ); Sat, 6 Feb 2021 03:56:08 -0500 Received: from www.linuxtv.org ([130.149.80.248]:48288 "EHLO www.linuxtv.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229534AbhBFI4H (ORCPT ); Sat, 6 Feb 2021 03:56:07 -0500 Received: from mchehab by www.linuxtv.org with local (Exim 4.92) (envelope-from ) id 1l8JBb-00EcHx-0Z; Sat, 06 Feb 2021 08:43:23 +0000 From: Mauro Carvalho Chehab Date: Sat, 06 Feb 2021 07:38:06 +0000 Subject: [git:media_tree/master] media: i2c: max9286: fix access to unallocated memory To: linuxtv-commits@linuxtv.org Cc: Tomi Valkeinen , Kieran Bingham , Laurent Pinchart , Sakari Ailus , stable@vger.kernel.org Mail-followup-to: linux-media@vger.kernel.org Forward-to: linux-media@vger.kernel.org Reply-to: linux-media@vger.kernel.org Message-Id: Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is an automatic generated email to let you know that the following patch were queued: Subject: media: i2c: max9286: fix access to unallocated memory Author: Tomi Valkeinen Date: Mon Jan 18 09:14:46 2021 +0100 The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be of size max9286_asd, otherwise access to max9286_asd->source will go to unallocated memory. Fixes: 86d37bf31af6 ("media: i2c: max9286: Allocate v4l2_async_subdev dynamically") Signed-off-by: Tomi Valkeinen Cc: stable@vger.kernel.org # v5.10+ Reviewed-by: Laurent Pinchart Reviewed-by: Kieran Bingham Tested-by: Kieran Bingham Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab drivers/media/i2c/max9286.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c index c82c1493e099..b1e2476d3c9e 100644 --- a/drivers/media/i2c/max9286.c +++ b/drivers/media/i2c/max9286.c @@ -580,7 +580,7 @@ static int max9286_v4l2_notifier_register(struct max9286_priv *priv) asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier, source->fwnode, - sizeof(*asd)); + sizeof(struct max9286_asd)); if (IS_ERR(asd)) { dev_err(dev, "Failed to add subdev for source %u: %ld", i, PTR_ERR(asd));