drivers/media/platform/qcom/camss/camss.c | 155 ++++++++++-------------------- 1 file changed, 52 insertions(+), 103 deletions(-)
This reverts commit cc1ecabe67d92a2da0b0402f715598e8dbdc3b9e.
This commit has a basic flaw in that it relies on camss->res->csid_num as a
control to index the array camss->vfe[i].
Testing on a platform where csid_num > vfe_num showed this bug up.
camss->vfe should only be indexed by camss->res->vfe_num. Since this commit
is meant to make the code be more readable reverting will simply restore
the previous correct bounds checking.
We can make another pass at making camss_link_entities look prettier but,
for now we should zap the bug introduced.
Fixes: cc1ecabe67d9 ("media: qcom: camss: Restructure camss_link_entities")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
---
v2:
- My SoB was under the --- fixed
- Leaving out cc stable because this is reverting a commit in next not
stable.
- Link to v1: https://lore.kernel.org/r/20241214-b4-linux-next-revert-link-freq-v1-1-5e970d05dfcd@linaro.org
v1:
Testing this commit out as I was adding in more CSID devices to my working
x1e tree I noticed a NULL pointer dereference in camss_link_entities.
Investigating I discovered the following indexing error:
> + for (i = 0; i < camss->res->csid_num; i++) {
> + if (camss->ispif)
> + line_num = camss->ispif->line_num;
> + else
> + line_num = camss->vfe[i].res->line_num;
This statement is incorrect, you are indexing vfe[] with a control derived
from csid_num.
Below is the statement removed.
> - for (i = 0; i < camss->res->csid_num; i++)
> - for (k = 0; k < camss->res->vfe_num; k++)
> - for (j = 0; j < camss->vfe[k].res->line_num; j++) {
As soon as csid_num > ARRAY_SIZE(vfe) the code breaks.
The commit is in linux-next but not yet in linux-stable so I'm not quite
sure what to do with a Fixes: tag nothing I think.
In any case we should revert this one before it hits stable.
Link: https://lore.kernel.org/linux-arm-msm/1a570c17-c501-4a29-a4f7-020f41563f3d@linaro.org
---
drivers/media/platform/qcom/camss/camss.c | 155 ++++++++++--------------------
1 file changed, 52 insertions(+), 103 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index 004a74f6b2f6ce7eef15765ad1eadc14a08a3908..a85e9df0f301a933d7e47e07b9fec535819aeb14 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2298,6 +2298,7 @@ static int camss_init_subdevices(struct camss *camss)
}
/*
+ * camss_link_entities - Register subdev nodes and create links
* camss_link_err - print error in case link creation fails
* @src_name: name for source of the link
* @sink_name: name for sink of the link
@@ -2315,64 +2316,14 @@ inline void camss_link_err(struct camss *camss,
}
/*
- * camss_link_entities_csid - Register subdev nodes and create links
- * @camss: CAMSS device
- *
- * Return 0 on success or a negative error code on failure
- */
-static int camss_link_entities_csid(struct camss *camss)
-{
- struct media_entity *src_entity;
- struct media_entity *sink_entity;
- int ret, line_num;
- u16 sink_pad;
- u16 src_pad;
- int i, j;
-
- for (i = 0; i < camss->res->csid_num; i++) {
- if (camss->ispif)
- line_num = camss->ispif->line_num;
- else
- line_num = camss->vfe[i].res->line_num;
-
- src_entity = &camss->csid[i].subdev.entity;
- for (j = 0; j < line_num; j++) {
- if (camss->ispif) {
- sink_entity = &camss->ispif->line[j].subdev.entity;
- src_pad = MSM_CSID_PAD_SRC;
- sink_pad = MSM_ISPIF_PAD_SINK;
- } else {
- sink_entity = &camss->vfe[i].line[j].subdev.entity;
- src_pad = MSM_CSID_PAD_FIRST_SRC + j;
- sink_pad = MSM_VFE_PAD_SINK;
- }
-
- ret = media_create_pad_link(src_entity,
- src_pad,
- sink_entity,
- sink_pad,
- 0);
- if (ret < 0) {
- camss_link_err(camss, src_entity->name,
- sink_entity->name,
- ret);
- return ret;
- }
- }
- }
-
- return 0;
-}
-
-/*
- * camss_link_entities_csiphy - Register subdev nodes and create links
+ * camss_link_entities - Register subdev nodes and create links
* @camss: CAMSS device
*
* Return 0 on success or a negative error code on failure
*/
-static int camss_link_entities_csiphy(struct camss *camss)
+static int camss_link_entities(struct camss *camss)
{
- int i, j;
+ int i, j, k;
int ret;
for (i = 0; i < camss->res->csiphy_num; i++) {
@@ -2392,68 +2343,66 @@ static int camss_link_entities_csiphy(struct camss *camss)
}
}
- return 0;
-}
-
-/*
- * camss_link_entities_ispif - Register subdev nodes and create links
- * @camss: CAMSS device
- *
- * Return 0 on success or a negative error code on failure
- */
-static int camss_link_entities_ispif(struct camss *camss)
-{
- int i, j, k;
- int ret;
-
- for (i = 0; i < camss->ispif->line_num; i++) {
- for (k = 0; k < camss->res->vfe_num; k++) {
- for (j = 0; j < camss->vfe[k].res->line_num; j++) {
- struct v4l2_subdev *ispif = &camss->ispif->line[i].subdev;
- struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
-
- ret = media_create_pad_link(&ispif->entity,
- MSM_ISPIF_PAD_SRC,
- &vfe->entity,
- MSM_VFE_PAD_SINK,
+ if (camss->ispif) {
+ for (i = 0; i < camss->res->csid_num; i++) {
+ for (j = 0; j < camss->ispif->line_num; j++) {
+ ret = media_create_pad_link(&camss->csid[i].subdev.entity,
+ MSM_CSID_PAD_SRC,
+ &camss->ispif->line[j].subdev.entity,
+ MSM_ISPIF_PAD_SINK,
0);
if (ret < 0) {
- camss_link_err(camss, ispif->entity.name,
- vfe->entity.name,
+ camss_link_err(camss,
+ camss->csid[i].subdev.entity.name,
+ camss->ispif->line[j].subdev.entity.name,
ret);
return ret;
}
}
}
+
+ for (i = 0; i < camss->ispif->line_num; i++)
+ for (k = 0; k < camss->res->vfe_num; k++)
+ for (j = 0; j < camss->vfe[k].res->line_num; j++) {
+ struct v4l2_subdev *ispif = &camss->ispif->line[i].subdev;
+ struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
+
+ ret = media_create_pad_link(&ispif->entity,
+ MSM_ISPIF_PAD_SRC,
+ &vfe->entity,
+ MSM_VFE_PAD_SINK,
+ 0);
+ if (ret < 0) {
+ camss_link_err(camss, ispif->entity.name,
+ vfe->entity.name,
+ ret);
+ return ret;
+ }
+ }
+ } else {
+ for (i = 0; i < camss->res->csid_num; i++)
+ for (k = 0; k < camss->res->vfe_num; k++)
+ for (j = 0; j < camss->vfe[k].res->line_num; j++) {
+ struct v4l2_subdev *csid = &camss->csid[i].subdev;
+ struct v4l2_subdev *vfe = &camss->vfe[k].line[j].subdev;
+
+ ret = media_create_pad_link(&csid->entity,
+ MSM_CSID_PAD_FIRST_SRC + j,
+ &vfe->entity,
+ MSM_VFE_PAD_SINK,
+ 0);
+ if (ret < 0) {
+ camss_link_err(camss, csid->entity.name,
+ vfe->entity.name,
+ ret);
+ return ret;
+ }
+ }
}
return 0;
}
-/*
- * camss_link_entities - Register subdev nodes and create links
- * @camss: CAMSS device
- *
- * Return 0 on success or a negative error code on failure
- */
-static int camss_link_entities(struct camss *camss)
-{
- int ret;
-
- ret = camss_link_entities_csiphy(camss);
- if (ret < 0)
- return ret;
-
- ret = camss_link_entities_csid(camss);
- if (ret < 0)
- return ret;
-
- if (camss->ispif)
- ret = camss_link_entities_ispif(camss);
-
- return ret;
-}
-
/*
* camss_register_entities - Register subdev nodes and create links
* @camss: CAMSS device
---
base-commit: 4176cf5c5651c33769de83bb61b0287f4ec7719f
change-id: 20241214-b4-linux-next-revert-link-freq-74ab5f2f7302
Best regards,
--
Bryan O'Donoghue <bryan.odonoghue@linaro.org>On 12/15/24 02:33, Bryan O'Donoghue wrote:
> This reverts commit cc1ecabe67d92a2da0b0402f715598e8dbdc3b9e.
>
> This commit has a basic flaw in that it relies on camss->res->csid_num as a
> control to index the array camss->vfe[i].
>
> Testing on a platform where csid_num > vfe_num showed this bug up.
>
> camss->vfe should only be indexed by camss->res->vfe_num. Since this commit
> is meant to make the code be more readable reverting will simply restore
> the previous correct bounds checking.
>
> We can make another pass at making camss_link_entities look prettier but,
> for now we should zap the bug introduced.
>
> Fixes: cc1ecabe67d9 ("media: qcom: camss: Restructure camss_link_entities")
> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
This change is very welcome.
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
--
Best wishes,
Vladimir
On 15/12/2024 11:58, Vladimir Zapolskiy wrote:
> On 12/15/24 02:33, Bryan O'Donoghue wrote:
>> This reverts commit cc1ecabe67d92a2da0b0402f715598e8dbdc3b9e.
>>
>> This commit has a basic flaw in that it relies on camss->res->csid_num
>> as a
>> control to index the array camss->vfe[i].
>>
>> Testing on a platform where csid_num > vfe_num showed this bug up.
>>
>> camss->vfe should only be indexed by camss->res->vfe_num. Since this
>> commit
>> is meant to make the code be more readable reverting will simply restore
>> the previous correct bounds checking.
>>
>> We can make another pass at making camss_link_entities look prettier but,
>> for now we should zap the bug introduced.
>>
>> Fixes: cc1ecabe67d9 ("media: qcom: camss: Restructure
>> camss_link_entities")
>> Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
>
> This change is very welcome.
>
> Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
>
> --
> Best wishes,
> Vladimir
Mauro.
Hans would normally merge for us in CAMSS but, he's on Xmas holidays.
Could I impose upon you to pick this one up directly ?
---
bod
© 2016 - 2025 Red Hat, Inc.