On Mon Dec 29 10:52:17 2025 +0300, Alper Ak wrote:
> vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop
> bound and passes the index to vfe_isr_reg_update(). However,
> vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):
>
> struct vfe_line line[VFE_LINE_NUM_MAX];
>
> When index is 4, 5, 6, the access to vfe->line[line_id] exceeds
> the array bounds and resulting in out-of-bounds memory access.
>
> Fix this by using separate loops for output lines and write masters.
>
> Fixes: 4edc8eae715c ("media: camss: Add initial support for VFE hardware
> version Titan 480")
> Signed-off-by: Alper Ak <[email protected]>
> Cc: [email protected]
> Reviewed-by: Bryan O'Donoghue <[email protected]>
> Signed-off-by: Bryan O'Donoghue <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/qcom/camss/camss-vfe-480.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/platform/qcom/camss/camss-vfe-480.c
b/drivers/media/platform/qcom/camss/camss-vfe-480.c
index 4feea590a47b..d73f733fde04 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-480.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-480.c
@@ -202,11 +202,13 @@ static irqreturn_t vfe_isr(int irq, void *dev)
writel_relaxed(status, vfe->base + VFE_BUS_IRQ_CLEAR(0));
writel_relaxed(1, vfe->base + VFE_BUS_IRQ_CLEAR_GLOBAL);
- /* Loop through all WMs IRQs */
- for (i = 0; i < MSM_VFE_IMAGE_MASTERS_NUM; i++) {
+ for (i = 0; i < MAX_VFE_OUTPUT_LINES; i++) {
if (status & BUS_IRQ_MASK_0_RDI_RUP(vfe, i))
vfe_isr_reg_update(vfe, i);
+ }
+ /* Loop through all WMs IRQs */
+ for (i = 0; i < MSM_VFE_IMAGE_MASTERS_NUM; i++) {
if (status & BUS_IRQ_MASK_0_COMP_DONE(vfe,
RDI_COMP_GROUP(i)))
vfe_buf_done(vfe, i);
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
