From nobody Sun Feb 8 18:30:36 2026 Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [213.167.242.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3EE52EC09C; Mon, 20 Oct 2025 08:25:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.167.242.64 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760948715; cv=none; b=LseULuekgckKSQMP+rmygR7EWVD+iIEPICQKTAYY0CBZKzQZZcABpKZunwGZ/F1HJ0uyhXlXZiSzqpJO441/6gDqi3cT9M+6gUa1tfsmepuZ1j+kgMnagevAmgRGv0FvkqX9FiLy26uHAilD6GoGsXNYLS9a/M/SbYoClT2KPYs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760948715; c=relaxed/simple; bh=7d66zFdIcUfNi1vjZ57PHiUP9ORNzyBprs9PXVWyxwA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TqODKBkfqFNjeGrX/3krqbnNERfsHZ76BaLqobakiIg9rQBti7MQH7MJGSMZW+2s0LmiG6s4sDFmWgUGZeJtB3Q91TCc48tH0LZxQdFoi+LSUZ3op2g1t6YUX+X/QipTaIaBcG/8zkOtU/ATUAw+/UdW44rdYGtlcAUL56yZtsM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ideasonboard.com; spf=pass smtp.mailfrom=ideasonboard.com; dkim=pass (1024-bit key) header.d=ideasonboard.com header.i=@ideasonboard.com header.b=pe88rvER; arc=none smtp.client-ip=213.167.242.64 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ideasonboard.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ideasonboard.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ideasonboard.com header.i=@ideasonboard.com header.b="pe88rvER" Received: from [192.168.1.102] (93-61-96-190.ip145.fastwebnet.it [93.61.96.190]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 2054D43; Mon, 20 Oct 2025 10:23:21 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1760948601; bh=7d66zFdIcUfNi1vjZ57PHiUP9ORNzyBprs9PXVWyxwA=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=pe88rvERNllri8hs11PIu48hiKF2qCt/8aeUJuNhC12ddzaQC9HHSeT84Plxiz6/+ fBpN9WKjYyphjBBGt3Zc9QmSHHWznfeauZtI9aK6mg1jN2Ru2j8NU87w3+3H8AwY4d PYEVbsb/8nDNdpuLVGVYz3DEbuqMba1YEHdE+m8k= From: Jacopo Mondi Date: Mon, 20 Oct 2025 10:24:53 +0200 Subject: [PATCH v8 7/8] media: amlogic-c3: Use v4l2-isp for validation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251020-extensible-parameters-validation-v8-7-afba4ba7b42d@ideasonboard.com> References: <20251020-extensible-parameters-validation-v8-0-afba4ba7b42d@ideasonboard.com> In-Reply-To: <20251020-extensible-parameters-validation-v8-0-afba4ba7b42d@ideasonboard.com> To: Dafna Hirschfeld , Laurent Pinchart , Keke Li , Mauro Carvalho Chehab , Heiko Stuebner , Dan Scally , Sakari Ailus , Antoine Bouyer Cc: linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linux-rockchip@lists.infradead.org, linux-arm-kernel@lists.infradead.org, Jacopo Mondi X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=8176; i=jacopo.mondi@ideasonboard.com; h=from:subject:message-id; bh=7d66zFdIcUfNi1vjZ57PHiUP9ORNzyBprs9PXVWyxwA=; b=owEBbQKS/ZANAwAKAXI0Bo8WoVY8AcsmYgBo9fHYRGyovYCqc/pw6dwc+xchRfreXRIvNCtGq K1rVbzSrS2JAjMEAAEKAB0WIQS1xD1IgJogio9YOMByNAaPFqFWPAUCaPXx2AAKCRByNAaPFqFW PD6/D/9j9Wk2KOR8vvUVXwbs8rZ3ZIrEW2ORGU4gJCCsM7LqSX7FC2Bxdx7Cuc+dlKVNauYcp0W lEsFx3ptn15GujCzZuV63WOCGMXcVT+wC8RGmdhGfAgi8Xrk1y/0jSIfrJ263BAE7fL6btu4toR fDrTAW4fEdJC1+BD8yNcF8iLgRTuSv8Cr8UlQzGEULSPY3rpg4S5Wv931MNVde33F+XI/G4IUVm 2ras9KxSurU4RBY4/uQ7n4vMUTFmSnx9zvRNQ9/zu5mT59tp2MKBn+DLsNkE+0X36LcvjJ+TYj0 LZD+9stdyXDtSxNtJPBsKW0SsPE+YQrgXS7hwdj1ZT6R9FdQeHWsmkbRJUob5l6x9vneiyoXxC3 8O0NyywyIC52y+dfG27SXSdJLnmFKqSYPf0XUfjk7wjD6hsEDwUUrg/EJ3z9xauo5rH0tbNze8l BeG9ffeUUu13ADAolTm/tKxvuupJPHVD2Wf3l5LJ6lliMvloze+NshlPBsQj5W/y021aRGu/+Ye JvMk9AgB4gVCz144QDcSv3130IeaWap0Ee5Va+BXDt8VfwbQuOzsMSLr9SOAQgAr0ZoJj5o4121 vsR6M4aOgi3mGoJIvuMokqv3impQ8ianpVRF2kcd8xEX2DxVbToQA77szXFfO1JlfYzEfenTOwt QFmXvQyfoYE4vKg== X-Developer-Key: i=jacopo.mondi@ideasonboard.com; a=openpgp; fpr=72392EDC88144A65C701EA9BA5826A2587AD026B Convert c3-isp-params.c to use the helpers defined in v4l2-isp.h to perform validation of a ISP parameters buffer. Reviewed-by: Keke Li Reviewed-by: Daniel Scally Acked-by: Sakari Ailus Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart --- drivers/media/platform/amlogic/c3/isp/Kconfig | 1 + .../media/platform/amlogic/c3/isp/c3-isp-params.c | 124 +++++------------= ---- 2 files changed, 27 insertions(+), 98 deletions(-) diff --git a/drivers/media/platform/amlogic/c3/isp/Kconfig b/drivers/media/= platform/amlogic/c3/isp/Kconfig index 02c62a50a5e88eac665e27abf163e5d654faed3f..809208cd7e3aa7ca0821cb07366= ec73a47edb278 100644 --- a/drivers/media/platform/amlogic/c3/isp/Kconfig +++ b/drivers/media/platform/amlogic/c3/isp/Kconfig @@ -10,6 +10,7 @@ config VIDEO_C3_ISP select VIDEO_V4L2_SUBDEV_API select VIDEOBUF2_DMA_CONTIG select VIDEOBUF2_VMALLOC + select V4L2_ISP help Video4Linux2 driver for Amlogic C3 ISP pipeline. The C3 ISP is used for processing raw images and diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/driver= s/media/platform/amlogic/c3/isp/c3-isp-params.c index c80667dd766210d2b2e1ee60c8254a5814b9d81b..0e031d64de312cfdf0a52a46f70= edbaf07563359 100644 --- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c +++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c @@ -8,6 +8,7 @@ #include =20 #include +#include #include #include =20 @@ -51,11 +52,6 @@ union c3_isp_params_block { typedef void (*c3_isp_block_handler)(struct c3_isp_device *isp, const union c3_isp_params_block *block); =20 -struct c3_isp_params_handler { - size_t size; - c3_isp_block_handler handler; -}; - #define to_c3_isp_params_buffer(vbuf) \ container_of(vbuf, struct c3_isp_params_buffer, vb) =20 @@ -523,38 +519,41 @@ static void c3_isp_params_cfg_blc(struct c3_isp_devic= e *isp, ISP_TOP_BEO_CTRL_BLC_EN); } =20 -static const struct c3_isp_params_handler c3_isp_params_handlers[] =3D { +static const c3_isp_block_handler c3_isp_params_handlers[] =3D { + [C3_ISP_PARAMS_BLOCK_AWB_GAINS] =3D c3_isp_params_cfg_awb_gains, + [C3_ISP_PARAMS_BLOCK_AWB_CONFIG] =3D c3_isp_params_cfg_awb_config, + [C3_ISP_PARAMS_BLOCK_AE_CONFIG] =3D c3_isp_params_cfg_ae_config, + [C3_ISP_PARAMS_BLOCK_AF_CONFIG] =3D c3_isp_params_cfg_af_config, + [C3_ISP_PARAMS_BLOCK_PST_GAMMA] =3D c3_isp_params_cfg_pst_gamma, + [C3_ISP_PARAMS_BLOCK_CCM] =3D c3_isp_params_cfg_ccm, + [C3_ISP_PARAMS_BLOCK_CSC] =3D c3_isp_params_cfg_csc, + [C3_ISP_PARAMS_BLOCK_BLC] =3D c3_isp_params_cfg_blc, +}; + +static const struct v4l2_isp_params_block_info c3_isp_params_blocks_info[]= =3D { [C3_ISP_PARAMS_BLOCK_AWB_GAINS] =3D { .size =3D sizeof(struct c3_isp_params_awb_gains), - .handler =3D c3_isp_params_cfg_awb_gains, }, [C3_ISP_PARAMS_BLOCK_AWB_CONFIG] =3D { .size =3D sizeof(struct c3_isp_params_awb_config), - .handler =3D c3_isp_params_cfg_awb_config, }, [C3_ISP_PARAMS_BLOCK_AE_CONFIG] =3D { .size =3D sizeof(struct c3_isp_params_ae_config), - .handler =3D c3_isp_params_cfg_ae_config, }, [C3_ISP_PARAMS_BLOCK_AF_CONFIG] =3D { .size =3D sizeof(struct c3_isp_params_af_config), - .handler =3D c3_isp_params_cfg_af_config, }, [C3_ISP_PARAMS_BLOCK_PST_GAMMA] =3D { .size =3D sizeof(struct c3_isp_params_pst_gamma), - .handler =3D c3_isp_params_cfg_pst_gamma, }, [C3_ISP_PARAMS_BLOCK_CCM] =3D { .size =3D sizeof(struct c3_isp_params_ccm), - .handler =3D c3_isp_params_cfg_ccm, }, [C3_ISP_PARAMS_BLOCK_CSC] =3D { .size =3D sizeof(struct c3_isp_params_csc), - .handler =3D c3_isp_params_cfg_csc, }, [C3_ISP_PARAMS_BLOCK_BLC] =3D { .size =3D sizeof(struct c3_isp_params_blc), - .handler =3D c3_isp_params_cfg_blc, }, }; =20 @@ -568,14 +567,14 @@ static void c3_isp_params_cfg_blocks(struct c3_isp_pa= rams *params) =20 /* Walk the list of parameter blocks and process them */ while (block_offset < config->data_size) { - const struct c3_isp_params_handler *block_handler; const union c3_isp_params_block *block; + c3_isp_block_handler block_handler; =20 block =3D (const union c3_isp_params_block *) &config->data[block_offset]; =20 - block_handler =3D &c3_isp_params_handlers[block->header.type]; - block_handler->handler(params->isp, block); + block_handler =3D c3_isp_params_handlers[block->header.type]; + block_handler(params->isp, block); =20 block_offset +=3D block->header.size; } @@ -771,26 +770,15 @@ static int c3_isp_params_vb2_buf_prepare(struct vb2_b= uffer *vb) struct vb2_v4l2_buffer *vbuf =3D to_vb2_v4l2_buffer(vb); struct c3_isp_params_buffer *buf =3D to_c3_isp_params_buffer(vbuf); struct c3_isp_params *params =3D vb2_get_drv_priv(vb->vb2_queue); - struct c3_isp_params_cfg *cfg =3D buf->cfg; struct c3_isp_params_cfg *usr_cfg =3D vb2_plane_vaddr(vb, 0); size_t payload_size =3D vb2_get_plane_payload(vb, 0); - size_t header_size =3D offsetof(struct c3_isp_params_cfg, data); - size_t block_offset =3D 0; - size_t cfg_size; - - /* Payload size can't be greater than the destination buffer size */ - if (payload_size > params->vfmt.fmt.meta.buffersize) { - dev_dbg(params->isp->dev, - "Payload size is too large: %zu\n", payload_size); - return -EINVAL; - } + struct c3_isp_params_cfg *cfg =3D buf->cfg; + int ret; =20 - /* Payload size can't be smaller than the header size */ - if (payload_size < header_size) { - dev_dbg(params->isp->dev, - "Payload size is too small: %zu\n", payload_size); - return -EINVAL; - } + ret =3D v4l2_isp_params_validate_buffer_size(params->isp->dev, vb, + params->vfmt.fmt.meta.buffersize); + if (ret) + return ret; =20 /* * Use the internal scratch buffer to avoid userspace modifying @@ -798,70 +786,10 @@ static int c3_isp_params_vb2_buf_prepare(struct vb2_b= uffer *vb) */ memcpy(cfg, usr_cfg, payload_size); =20 - /* Only v0 is supported at the moment */ - if (cfg->version !=3D C3_ISP_PARAMS_BUFFER_V0) { - dev_dbg(params->isp->dev, - "Invalid params buffer version: %u\n", cfg->version); - return -EINVAL; - } - - /* Validate the size reported in the parameter buffer header */ - cfg_size =3D header_size + cfg->data_size; - if (cfg_size !=3D payload_size) { - dev_dbg(params->isp->dev, - "Data size %zu and payload size %zu are different\n", - cfg_size, payload_size); - return -EINVAL; - } - - /* Walk the list of parameter blocks and validate them */ - cfg_size =3D cfg->data_size; - while (cfg_size >=3D sizeof(struct c3_isp_params_block_header)) { - const struct c3_isp_params_block_header *block; - const struct c3_isp_params_handler *handler; - - block =3D (struct c3_isp_params_block_header *) - &cfg->data[block_offset]; - - if (block->type >=3D ARRAY_SIZE(c3_isp_params_handlers)) { - dev_dbg(params->isp->dev, - "Invalid params block type\n"); - return -EINVAL; - } - - if (block->size > cfg_size) { - dev_dbg(params->isp->dev, - "Block size is greater than cfg size\n"); - return -EINVAL; - } - - if ((block->flags & (C3_ISP_PARAMS_BLOCK_FL_ENABLE | - C3_ISP_PARAMS_BLOCK_FL_DISABLE)) =3D=3D - (C3_ISP_PARAMS_BLOCK_FL_ENABLE | - C3_ISP_PARAMS_BLOCK_FL_DISABLE)) { - dev_dbg(params->isp->dev, - "Invalid parameters block flags\n"); - return -EINVAL; - } - - handler =3D &c3_isp_params_handlers[block->type]; - if (block->size !=3D handler->size) { - dev_dbg(params->isp->dev, - "Invalid params block size\n"); - return -EINVAL; - } - - block_offset +=3D block->size; - cfg_size -=3D block->size; - } - - if (cfg_size) { - dev_dbg(params->isp->dev, - "Unexpected data after the params buffer end\n"); - return -EINVAL; - } - - return 0; + return v4l2_isp_params_validate_buffer(params->isp->dev, vb, + (struct v4l2_isp_params_buffer *)cfg, + c3_isp_params_blocks_info, + ARRAY_SIZE(c3_isp_params_blocks_info)); } =20 static int c3_isp_params_vb2_buf_init(struct vb2_buffer *vb) --=20 2.51.0