From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 584E617DE36; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=OrARssVwApJfIJ/bsJ1HRrDbwQYlmVvspo0f1nTgz+o87IrhaFb3+Eu8mzgoR9iZV3T6Iar2jNLxN5zLvwMC4XZnjnn7BzqwV9PAEqzDlC2LKkROO6B4veJ0ibA8g77Up1Yd2JXphmO1ermIEZxrso+jY1NfPVz5Le2sOcvS5GY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=DHJgypSXNIsIfOeTJX/YlS19CLFwnkCqj3yo7u5yJ2k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tfc7cuKwlMe7yj4RbdptQxkAOGidQ90J6vJuUzb14skDMN8EV7OFlIHfKyZxFcgKRhxObdTho2yR2zmwNoLe6HIaum2I9A0tsjiXu8sduhL85imD9bu+c7pa2x4FQJ681/9YeYuSLs3LcPXtouWENELU8kLFkTBGEV5HYWhpOy0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=O2V9amAP; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="O2V9amAP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C46CDC4CED7; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=DHJgypSXNIsIfOeTJX/YlS19CLFwnkCqj3yo7u5yJ2k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O2V9amAPkS5QKtYA9KhunCg5Pvu7Wo66lRXGGzJjCP4ZA4RyiPvAZCh7uWG0yX0NY 6aiy1qg8AaIuaz26yb9YZcHoTnT1iY6vyC//eqrJRUupTnUhoEW2+2UbIj7e5mLLtQ OY6yP/4gXswxRIfVmYOdKE/PTUA0VUDElFVEBkhZNIDiAQw97Y/1EUXoTVCYKtGZmr JYutbIBZggim+PQwlBdYe1VKGCIWePAmsYutBRWWnoyBr/4BL4yoGWVaQ5doFVHG29 9T0Va4lRFwT/KE4aqIZHF+GXDzLpoiJOcjExb3o+ea9qjxMPMOYKhunppH24+H+zT9 sb4lgfvmCmQMQ== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Mdx-1FuL; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , Ricardo Ribalda , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 01/13] media: v4l2-ctrls-api: fix error handling for v4l2_g_ctrl() Date: Fri, 18 Oct 2024 07:53:03 +0200 Message-ID: <4d36ccf66f48a870c9bc0f7e9fda595505c4d342.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" As detected by Coverity, the error check logic at get_ctrl() is broken: if ptr_to_user() fails to fill a control due to an error, no errors are returned and v4l2_g_ctrl() returns success on a failed operation, which may cause applications to fail. Add an error check at get_ctrl() and ensure that it will be returned to userspace without filling the control value if get_ctrl() fails. Fixes: 71c689dc2e73 ("media: v4l2-ctrls: split up into four source files") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/v4l2-core/v4l2-ctrls-api.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-= core/v4l2-ctrls-api.c index e5a364efd5e6..a0de7eeaf085 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls-api.c +++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c @@ -753,9 +753,10 @@ static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l= 2_ext_control *c) for (i =3D 0; i < master->ncontrols; i++) cur_to_new(master->cluster[i]); ret =3D call_op(master, g_volatile_ctrl); - new_to_user(c, ctrl); + if (!ret) + ret =3D new_to_user(c, ctrl); } else { - cur_to_user(c, ctrl); + ret =3D cur_to_user(c, ctrl); } v4l2_ctrl_unlock(master); return ret; @@ -770,7 +771,10 @@ int v4l2_g_ctrl(struct v4l2_ctrl_handler *hdl, struct = v4l2_control *control) if (!ctrl || !ctrl->is_int) return -EINVAL; ret =3D get_ctrl(ctrl, &c); - control->value =3D c.value; + + if (!ret) + control->value =3D c.value; + return ret; } EXPORT_SYMBOL(v4l2_g_ctrl); @@ -811,10 +815,12 @@ static int set_ctrl_lock(struct v4l2_fh *fh, struct v= 4l2_ctrl *ctrl, int ret; =20 v4l2_ctrl_lock(ctrl); - user_to_new(c, ctrl); + ret =3D user_to_new(c, ctrl); + if (ret) + return ret; ret =3D set_ctrl(fh, ctrl, 0); if (!ret) - cur_to_user(c, ctrl); + ret =3D cur_to_user(c, ctrl); v4l2_ctrl_unlock(ctrl); return ret; } --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AF0018787A; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=siW4tWNCpaLFW3wAE1ztbi+I12j8b0LGEE7lfvsRHWUT6QYQfbqy1klu/xqNCTlwd2WzyVDuapvmvpX1orGeEoGW6HyaemuyqiAi/agZkD7RspQ8kUR7JA2Y2WbweE4AY2Kpm3+ZAhzv+zlTMLoMKUR+tPUpW3HHhtS70OzDS5Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=LtBSUA7B+3VtO9zE32j3VEtv7Mc19nC7jsWGMOsbHxw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PJz0TwUJEspHCS5oPxSUk3RsYBRf/85aStYK76W/I5k8tTdcoxqzhlCQrGSrDYyGC8y4PMt4W9eqgB/3EThbtHST0jxJgKpyAFEV2XXfEReXDUwln+PY1h8Nx7HmuBeGZbn/xmSCWZlK7Yz27dx8/xSW9nWPmBIpSHaky+eupWo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hSi5Aokm; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hSi5Aokm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB865C4CED3; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=LtBSUA7B+3VtO9zE32j3VEtv7Mc19nC7jsWGMOsbHxw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hSi5Aokm1GFJ2zASIYQbzaJRHNcPg07FZvuYQw7kNwNPUK/G+NLBBZnUMtsTb6umC m9qipTCK7wJ4K2ChUsYygArXeMy0AIPWZfRScKwVZ2Uf+B/skhIZBQP6A/PSFAz392 If//WzriECL1hwvaZmMihWtdxU4SqteBBQZZEG7DgYZIucD7r2H32cUvv+bKXnxtyc XEaf5XLSNehdN5w5i2o50ciujJYrfnfucRDoaiZ+adumyW8kcIv6NkzIzoLaymY/i6 9HQDZZU28A/xtvoR1NCb9x2tyRIqI6/uMnMwU9WMeombDnrUBu2ndCk5SjonMzbVBy /f5MX1JLoMNbQ== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Me0-1Mai; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , Zhipeng Lu , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 02/13] media: v4l2-tpg: prevent the risk of a division by zero Date: Fri, 18 Oct 2024 07:53:04 +0200 Message-ID: <141426ff0a1fcd99a82b57ad0ab7389bb5d5a072.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero. Instead, add a WARN_ON_ONCE() to trigger such cases and return without doing any precalculation. Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/= common/v4l2-tpg/v4l2-tpg-core.c index c86343a4d0bf..940bfbf275ce 100644 --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tp= g) unsigned p; unsigned x; =20 + if (WARN_ON_ONCE(!tpg->src_width || !tpg->scaled_width)) + return; + switch (tpg->pattern) { case TPG_PAT_GREEN: contrast =3D TPG_COLOR_100_RED; --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E323187FE7; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=tcc2ouyc0Z6S2joNVRF1LRxu/uq20IxGcukbHTSY3uBYhsdm9LVcqp/ad78GyxKYuAukMoPnkT+8+v1VkE+1aaUsur2PTjiG+lERFNwoHsQ4Mgy80HEZpvaPeoi7SDTKq+dxSKA3z5vnrNNEqK3D6No7ii4s1ovxV+2mGbyJAgI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=7VY8GlY/l5T5jEHgBbjy0pf1hM8mOLn8XMfWYVIqYHg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=efgBJv7Z+HpegZQLGfWPBvfm3i9jPV5taHbOe5Ayg5IDwz8uDCk+sLLB9PUN4GeHHtUbVMbXfWUYWrgD71tTwWQnqu45AQS/aEprx90pD2nAXvFUAg0VV2xnTaL4jxWcwUDerL9750zYwYHtVjXXH2lZWV43fRcLcaRojDBdWoQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Sdu9pKx4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Sdu9pKx4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9739C4CEDA; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=7VY8GlY/l5T5jEHgBbjy0pf1hM8mOLn8XMfWYVIqYHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Sdu9pKx4pBfpb2BCmX4XRHpr0ne0We1ZiOjjGDcnJz0q/TY0lXLP8QNniSKfY7fbf ct5NW0c67lyUjcGizX87/xi5CxEwbbQx4IJZgBXgUyicMCDvgjCHewkMKWnU8v7orU 5qRZWVfhniHji9Dah9pmNIHu5b742nzczdWZXoEpx9FLY4F/FaOhTUN8n4buP/x+H9 0sgfOulBYttY/tZu+Muq3O3eBio7ddAoEJpi2A07pwrZlQ68WYQm/OF5AFbCmzPTsm oL5WDMLlqSJx326SktIcCtneL/tEZ406+ryIoRk0ougm/9Y2gUR704Eei9Jcn5FZpO MHDh6yceXHw5A== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Me3-1TQd; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Andreas Oberritter , Dan Carpenter , Hans Verkuil , Mauro Carvalho Chehab , Ricardo Ribalda , Zhipeng Lu , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH v2 03/13] media: dvbdev: prevent the risk of out of memory access Date: Fri, 18 Oct 2024 07:53:05 +0200 Message-ID: <9e1b9363b98f322307459ffde548ad9948a1541b.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The dvbdev contains a static variable used to store dvb minors. The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set, dvb_register_device() won't check for boundaries, as it will rely that a previous call to dvb_register_adapter() would already be enforcing it. On a similar way, dvb_device_open() uses the assumption that the register functions already did the needed checks. This can be fragile if some device ends using different calls. This also generate warnings on static check analysers like Coverity. So, add explicit guards to prevent potential risk of OOM issues. Fixes: 5dd3f3071070 ("V4L/DVB (9361): Dynamic DVB minor allocation") Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvbdev.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbde= v.c index b43695bc51e7..14f323fbada7 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -86,10 +86,15 @@ static DECLARE_RWSEM(minor_rwsem); static int dvb_device_open(struct inode *inode, struct file *file) { struct dvb_device *dvbdev; + unsigned int minor =3D iminor(inode); + + if (minor >=3D MAX_DVB_MINORS) + return -ENODEV; =20 mutex_lock(&dvbdev_mutex); down_read(&minor_rwsem); - dvbdev =3D dvb_minors[iminor(inode)]; + + dvbdev =3D dvb_minors[minor]; =20 if (dvbdev && dvbdev->fops) { int err =3D 0; @@ -525,7 +530,7 @@ int dvb_register_device(struct dvb_adapter *adap, struc= t dvb_device **pdvbdev, for (minor =3D 0; minor < MAX_DVB_MINORS; minor++) if (!dvb_minors[minor]) break; - if (minor =3D=3D MAX_DVB_MINORS) { + if (minor >=3D MAX_DVB_MINORS) { if (new_node) { list_del(&new_node->list_head); kfree(dvbdevfops); @@ -540,6 +545,14 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, } #else minor =3D nums2minor(adap->num, type, id); + if (minor >=3D MAX_DVB_MINORS) { + dvb_media_device_free(dvbdev); + list_del(&dvbdev->list_head); + kfree(dvbdev); + *pdvbdev =3D NULL; + mutex_unlock(&dvbdev_register_lock); + return ret; + } #endif dvbdev->minor =3D minor; dvb_minors[minor] =3D dvb_device_get(dvbdev); --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59ECD186E38; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=d7pDcVLcVy3FQzq6MK8MRVdaJekiS9Tmi61awF6ON/uILyErdOHQpinqin3yfOhbG+oXDprfuaA298dgc6nQ2yIyB7Qe3aGM8CLd/avUX3UfEBkbO6tjE+hs4S3JcxSc/w1VNlw1bShxVyiKbvbyAWYL14jxdZwWV9yGSfO3GrA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=uzjAOucrKtfD0CkwggkoeV+VI4yHBkB0yUqlDwNCYzE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=f4BW8tKsw5u9SOnJbm4lk0jP7bbTkYDo9UC8cBfCNsekbdz+Jv50v3209ib9nTo1CZcrImtEy00ReU4FqxrEEsjGYR2iX4e5yygQliWligATFNszTikWUToAYr6PogqBlsevh+kG3HVegtqtgTfKiDkXU1/+6ow1NIzu1HMpvD4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=W+Jbzur8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="W+Jbzur8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3281C4CED5; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=uzjAOucrKtfD0CkwggkoeV+VI4yHBkB0yUqlDwNCYzE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W+Jbzur8gQa3WeSILcq5SqXpKOdpGjQdG3f7ki9BoTgKxUHokuM+vVVi7e0NP/HRI Woumuqvy8nG8scgdsABMF25uDA87eek/M4igOCdBfIt1VT01lI3XKVW7H+A50NEbNo Nxr8HFryDEMTqJ9VdKSfVQFcxsYyrYiq2k6uh8E0Bqy7l+Udfkowcq2aAYcOLJ3Oiu 6tAU17lqBYQQV292tcurxgOGRSHhvHSZ78cs41Lq/VHu6YmTBUwlz8PuwmNlwdf/ot zNoqTkEZlzSErlZgTeNp/xwjcwV8rFL0wuTU2cOOeYIDH1wwDhP4QPvAFD8fNC1e3Q NFXAeOJtkf+tA== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Me9-1a5W; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Kevin Hao , Mauro Carvalho Chehab , Philipp Stanner , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH v2 04/13] media: dvb_frontend: don't play tricks with underflow values Date: Fri, 18 Oct 2024 07:53:06 +0200 Message-ID: <8d6193ed8d53ce94d595cb431627bbc7783c0e4c.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" fepriv->auto_sub_step is unsigned. Setting it to -1 is just a trick to avoid calling continue, as reported by Coverity. It relies to have this code just afterwards: if (!ready) fepriv->auto_sub_step++; Simplify the code by simply setting it to zero and use continue to return to the while loop. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Philipp Stanner --- drivers/media/dvb-core/dvb_frontend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core= /dvb_frontend.c index d48f48fda87c..c9283100332a 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -443,8 +443,8 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_fr= ontend *fe, int check_wra =20 default: fepriv->auto_step++; - fepriv->auto_sub_step =3D -1; /* it'll be incremented to 0 in a moment = */ - break; + fepriv->auto_sub_step =3D 0; + continue; } =20 if (!ready) fepriv->auto_sub_step++; --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7ACD3187862; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=nM8a7niHciXG18wT6O3J4cMV2/6Mqc6U0fFY1Rh3EivAtKJ/2EspW+4qQWHSpHNxnTS2XT8kr6n+mud9TnveVDlFaWiu675mRsvI9poH4kjf66ogqchkjtJQzouSXguDeLxEOJXSOvSZHq2EQHMHA9jL1zjKp1GI2QujwdXYv2w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=lGWpAXxWV3zz4XGNsiMpE6t375yXbG2Tiq87XA+eXFc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=F4L8e/lbEvAz0c+3Jg8HhF1/nT4B5JpTS2s4Yyym36juXQWVJ4cqS63romTlf0NfsdAbO7g2sSQNdZnb81HDE6nkanEUk5bJIph4tHsFBEt2EpZ7f3VJ9L4XYP34pbiAMtSZoco6dvHdrV2ZmDDqt/j2aQIgHybr2EQ9hoMRSUw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gX8Vei/t; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gX8Vei/t" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDD63C4CED2; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=lGWpAXxWV3zz4XGNsiMpE6t375yXbG2Tiq87XA+eXFc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gX8Vei/tEEktbLeGqPL31wg87cH7/bnX6mQdsiTAZxq3oFxpXT51xPFppxECcf8qV 2K+Fd6J1w7OBkzSlWVXsjuOKte+IEUvp9LMJr9JZ+W/AJ04LePmjHgchRRfW9gZ9ik qr6c+OJ+/CVxxXo4xsdR9f0XeNmT8yff//sR3OZIczW9MtRHsMs5JRVpNNEOAtYKiU gDFzS9oRLfeHab5Y4tLURTNMWa8PHqn4xeGvnrBEDggxX3pYWvlvK6cJkoSqIvEIXb Yl5Fqg/bXR5pEUi9bYu9p4xqzmRr4RvByak9tS2bA8XwrK15fPORdZpR27r0un7ASi HY9IdjGSHVdrw== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeD-1goc; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Martin Tuma , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 05/13] media: mgb4: protect driver against spectre Date: Fri, 18 Oct 2024 07:53:07 +0200 Message-ID: X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Frequency range is set from sysfs via frequency_range_store(), being vulnerable to spectre, as reported by smatch: drivers/media/pci/mgb4/mgb4_cmt.c:231 mgb4_cmt_set_vin_freq_range() warn: = potential spectre issue 'cmt_vals_in' [r] drivers/media/pci/mgb4/mgb4_cmt.c:238 mgb4_cmt_set_vin_freq_range() warn: = possible spectre second half. 'reg_set' Fix it. Fixes: 0ab13674a9bd ("media: pci: mgb4: Added Digiteq Automotive MGB4 drive= r") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Martin T=C5=AFma --- drivers/media/pci/mgb4/mgb4_cmt.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/pci/mgb4/mgb4_cmt.c b/drivers/media/pci/mgb4/mgb= 4_cmt.c index 70dc78ef193c..a25b68403bc6 100644 --- a/drivers/media/pci/mgb4/mgb4_cmt.c +++ b/drivers/media/pci/mgb4/mgb4_cmt.c @@ -227,6 +227,8 @@ void mgb4_cmt_set_vin_freq_range(struct mgb4_vin_dev *v= indev, u32 config; size_t i; =20 + freq_range =3D array_index_nospec(freq_range, ARRAY_SIZE(cmt_vals_in)); + addr =3D cmt_addrs_in[vindev->config->id]; reg_set =3D cmt_vals_in[freq_range]; =20 --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2548B17CA03; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=LClohbfwixkf/b0rysoSsTs0xaVJ8RITy2snf8h80B/JgiYhg8v7rl/gwD0/35ZdvBSYiHyC+ssCFoZhUS6P0tYOV2sZHcG6kmP1FrRuxOwZfGR5bQfYP6zOJX56cVqCabj1mH9TWd8USmidg0+RsvyfQ2B0kq/DvJJgjNVpUog= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=uwXxWFWVLKeBra7Pb/skSKfPY8KH3t9pzk1shDbiY6g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dQcY23RqxPXav5AZdRhVHUmnlQm1RKQQ+SmdJgNG62pRGh1DnwLuY+HxHx6wilv0aBJ1XRXU/CDsuMG8RucgcoMmLh9olD+jPSkuoA4e9qbF0hlByL29C0xB8XeIocBxhe8rMC+xA0od3PmRaMfn2dzRamn6+d9Fys3+A8QJzPc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FJOGoIU2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FJOGoIU2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB5E3C4CEC3; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=uwXxWFWVLKeBra7Pb/skSKfPY8KH3t9pzk1shDbiY6g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FJOGoIU2Q45yW0qt/8ilOvDJLoCye2VDr0j86pQ8A/A5UKO0rfBpLyksmQsXYUYNZ vHzw93zra8s62utOy1gHXsktkCvX2H/ACGVj2MC1934mZfVSVz6edB5WYLuaB9Ki72 q9lt4vlODPaFAV2OS/SXk3+JoZ+9rkakrfKOsqrUfGVwQrGev05CnSNVxgh9zXDwtJ JwZHZfYQWIkWT5G/i7JRPSqsCrp+BmUL0xhGfsCxcArQ4jqU+WFh4/KKWsqFB6APKz 2GP/dG17ficpIRkPIXnBVkREz47jpCLwT4B7+RovnObgOV0aHjkkndHhznAaIGQBGe a6bIXzTEM3MtQ== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeH-1nY0; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , Mauro Carvalho Chehab , Stefan Herdler , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linux-staging@lists.linux.dev, stable@vger.kernel.org Subject: [PATCH v2 06/13] media: av7110: fix a spectre vulnerability Date: Fri, 18 Oct 2024 07:53:08 +0200 Message-ID: X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potentia= l spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/av7110/av7110.h | 4 +++- drivers/staging/media/av7110/av7110_ca.c | 25 ++++++++++++++++-------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/drivers/staging/media/av7110/av7110.h b/drivers/staging/media/= av7110/av7110.h index ec461fd187af..b584754f4be0 100644 --- a/drivers/staging/media/av7110/av7110.h +++ b/drivers/staging/media/av7110/av7110.h @@ -88,6 +88,8 @@ struct infrared { u32 ir_config; }; =20 +#define MAX_CI_SLOTS 2 + /* place to store all the necessary device information */ struct av7110 { /* devices */ @@ -163,7 +165,7 @@ struct av7110 { =20 /* CA */ =20 - struct ca_slot_info ci_slot[2]; + struct ca_slot_info ci_slot[MAX_CI_SLOTS]; =20 enum av7110_video_mode vidmode; struct dmxdev dmxdev; diff --git a/drivers/staging/media/av7110/av7110_ca.c b/drivers/staging/med= ia/av7110/av7110_ca.c index 6ce212c64e5d..fce4023c9dea 100644 --- a/drivers/staging/media/av7110/av7110_ca.c +++ b/drivers/staging/media/av7110/av7110_ca.c @@ -26,23 +26,28 @@ =20 void CI_handle(struct av7110 *av7110, u8 *data, u16 len) { + unsigned slot_num; + dprintk(8, "av7110:%p\n", av7110); =20 if (len < 3) return; switch (data[0]) { case CI_MSG_CI_INFO: - if (data[2] !=3D 1 && data[2] !=3D 2) + if (data[2] !=3D 1 && data[2] !=3D MAX_CI_SLOTS) break; + + slot_num =3D array_index_nospec(data[2] - 1, MAX_CI_SLOTS); + switch (data[1]) { case 0: - av7110->ci_slot[data[2] - 1].flags =3D 0; + av7110->ci_slot[slot_num].flags =3D 0; break; case 1: - av7110->ci_slot[data[2] - 1].flags |=3D CA_CI_MODULE_PRESENT; + av7110->ci_slot[slot_num].flags |=3D CA_CI_MODULE_PRESENT; break; case 2: - av7110->ci_slot[data[2] - 1].flags |=3D CA_CI_MODULE_READY; + av7110->ci_slot[slot_num].flags |=3D CA_CI_MODULE_READY; break; } break; @@ -262,15 +267,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned i= nt cmd, void *parg) case CA_GET_SLOT_INFO: { struct ca_slot_info *info =3D (struct ca_slot_info *)parg; + unsigned int slot_num; =20 if (info->num < 0 || info->num > 1) { mutex_unlock(&av7110->ioctl_mutex); return -EINVAL; } - av7110->ci_slot[info->num].num =3D info->num; - av7110->ci_slot[info->num].type =3D FW_CI_LL_SUPPORT(av7110->arm_app) ? - CA_CI_LINK : CA_CI; - memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info)); + slot_num =3D array_index_nospec(info->num, MAX_CI_SLOTS); + + av7110->ci_slot[slot_num].num =3D info->num; + av7110->ci_slot[slot_num].type =3D FW_CI_LL_SUPPORT(av7110->arm_app) ? + CA_CI_LINK : CA_CI; + memcpy(info, &av7110->ci_slot[slot_num], + sizeof(struct ca_slot_info)); break; } =20 --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 253ED17C9B9; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=RSYA+DhpDJIiu0mvz05QxVDAbfj6BIGCjFZ0MMXg/CBCNX8ymqWsHvR9zMk+PPmk41EX08FrJlN/Yxg04O2ZfyldAgkYO+7/DQxzsmSRQyaf1yBsuv/oPBG373U0WP88DHKMlIlzsS4jHbntd5l2Fhr/4nDjk0RIosO89g/lkgk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=wVXSfTdlzHbzFNnkVyQi+BQqJKzdBu2IARFn0RCaO+M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dvomTix8m0hxaXCbSBs1AUZoKpIxZgvnyP8gBo6FexFXsIulpDwgYZgiyygq3T6IOhOocw1MKpMnklodZeK7zkSstXXMba0X9Rb/y+xqa0j4/IIB1s2AWSMVw/pXQRMGqDEblVlCqeePkg8Jpl4KW/jfW0e59FJckdE1GYLf+uU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=rcKa8wDU; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="rcKa8wDU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6F92C4CED1; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=wVXSfTdlzHbzFNnkVyQi+BQqJKzdBu2IARFn0RCaO+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rcKa8wDUnwuY0FJLrBxIUAGN44E/2NnZ8QzxgE9pfKxNX4Xuof00SUbx2CQeqlDan /wzOt+/tae2mSufNC8k0DATXp1O8oS2PDiNErWX2dNKhnlVaydX9cb5+RLZMx0mncS 67Jc+9ErK3C7ycsuH0VMell/QtaFRBVXIsqnUI+0J+O41mBqxK24rE6xzrmAMd8Cm6 zQt2CbfnZ8pSYP9slekMPX7+gPo+8RJAoqXcSGhAe6bysAvY9O1rCOPBxEud/Y/lm1 3rYHGjceh2E+v3ESEC7YJdTGlI6vx4AGaIeelBXpJNv0ebOzjTrMrdOs4tWVpSQAN1 N1O2YYH/EwDsg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeL-1uTx; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Andrzej Pietrasiewicz , Hans Verkuil , Jacek Anaszewski , Mauro Carvalho Chehab , Sylwester Nawrocki , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 07/13] media: s5p-jpeg: prevent buffer overflows Date: Fri, 18 Oct 2024 07:53:09 +0200 Message-ID: <172461a2e8b2a1a4f01add73afae777463ea0fb8.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word =3D 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Jacek Anaszewski --- .../media/platform/samsung/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c b/drivers/= media/platform/samsung/s5p-jpeg/jpeg-core.c index d2c4a0178b3c..1db4609b3557 100644 --- a/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5= p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr =3D 0; =20 - word =3D 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size =3D (long)word - 2; + + if (word < 2) + jpeg_buffer.size =3D 0; + else + jpeg_buffer.size =3D (long)word - 2; + jpeg_buffer.data +=3D 2; jpeg_buffer.curr =3D 0; =20 @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, u= nsigned int *word) if (byte =3D=3D -1) return -1; *word =3D (unsigned int)byte | temp; + return 0; } =20 @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; - if (!length) + if (length <=3D 0) return false; sof =3D jpeg_buffer.curr; /* after 0xffc0 */ sof_len =3D length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; - if (!length) + if (length <=3D 0) return false; if (n_dqt >=3D S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; - if (!length) + if (length <=3D 0) return false; if (n_dht >=3D S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data= *result, if (get_word_be(&jpeg_buffer, &word)) break; length =3D (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C6A3187FE0; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=F7BLBQzumm5YDvwWoQV2D28mpqOS8b3UQ43mxx5wXPns2QzrlU2Hy9whed1brHjKO4D9JMvY9VmQsYKBZO607G7rA5AnHctptWYfOCb+0gRvRcaj4DyjYTOsJOpRYctkSq9UR43Zev+mhGSpSTVVOoLQvEVyhEq+IAqjWzMV7wo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=O3hpbSeOL0uAXgzCljfnSBcEgFxc7j1/lfQWoHbchgM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ckx6xNybMmsWtyAAeOALr9av6WKuD/Okg17OpJMnQGeA66xP3IWnQ/BmdEQQQVTTNvefzzA1HYYYbbpNgJswZ8c7/amQDIcU04XhyOPP/RuAXMmGxAf3tnRCc4hTbdmtf0aV4ACSCQ660d71oFCJlZh7wuk8ORjzUgSJ1Rh544Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cuxLdK4g; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cuxLdK4g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7034C4CED9; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=O3hpbSeOL0uAXgzCljfnSBcEgFxc7j1/lfQWoHbchgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cuxLdK4gBqS2R0swC80bPRnaFtVyfJxdsfDtSfTKX+y6+suQ6QP83aHyUQMfMmrMm 2xcCh/m61LZydV47EM0tej5yVlJY1xx+UfW10I2dvTZ6bg9SfUafUkWVNdoKtHqmoU 2u9Da5GzfToHh0c6E+NQeT6F1AB8YTilpx78F91EmWCpWZ6/C0fXhOMM2ZNMc/NFg2 q3QczZuUuZfNeNoAD1KpQqWE1cdhAF7TZ8JUMpRjkpJ4tTWnavEhgdQ5LEKuWoK7kW upy1qWsY8aCS4kWDMmL1AVUfK2Ko53Y0aFdHYJXwK1wyxNQt9ZTryW3YCxiWGbw+UV OWGDADwHx50Dw== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeP-21Cp; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= , Mauro Carvalho Chehab , Sakari Ailus , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 08/13] media: ar0521: don't overflow when checking PLL values Date: Fri, 18 Oct 2024 07:53:10 +0200 Message-ID: <384bc1320658b93b43838a337b37d52dc8485df2.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The PLL checks are comparing 64 bit integers with 32 bit ones, as reported by Coverity. Depending on the values of the variables, this may underflow. Fix it ensuring that both sides of the expression are u64. Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab Acked-by: Sakari Ailus Acked-by: Krzysztof Ha=C5=82asa --- drivers/media/i2c/ar0521.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/ar0521.c b/drivers/media/i2c/ar0521.c index fc27238dd4d3..24873149096c 100644 --- a/drivers/media/i2c/ar0521.c +++ b/drivers/media/i2c/ar0521.c @@ -255,10 +255,10 @@ static u32 calc_pll(struct ar0521_dev *sensor, u32 fr= eq, u16 *pre_ptr, u16 *mult continue; /* Minimum value */ if (new_mult > 254) break; /* Maximum, larger pre won't work either */ - if (sensor->extclk_freq * (u64)new_mult < AR0521_PLL_MIN * + if (sensor->extclk_freq * (u64)new_mult < (u64)AR0521_PLL_MIN * new_pre) continue; - if (sensor->extclk_freq * (u64)new_mult > AR0521_PLL_MAX * + if (sensor->extclk_freq * (u64)new_mult > (u64)AR0521_PLL_MAX * new_pre) break; /* Larger pre won't work either */ new_pll =3D div64_round_up(sensor->extclk_freq * (u64)new_mult, --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AC76187861; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=KwxE0NV4MLmxeDDhIsexsrzSPqOkD8qFTRheJ6ze9VVpZMwFEzBbInYQwJVuiNgOcntD03eOmv+pFZnJg0lwPZVpnHaTkrMsipFiLrGmKWm5Y40UxlbseqUxDbHogHdxcoZFiS3tueOHcI21r8EqWv2e/bVCivICh0buVDez08c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=dURN9dIELtyC2m0Zlh5rzANJ1Ev1GACofUTUaXFiXig=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kLePTdgYFRdY6R/V3NnOdem7qgkgY8yAvD6ABIRITVYQdCwvR/fGpwuglXkS5kOO7yY9Ql9Zi3T8XE5AEhgrUU/G590Rx4oS+Bi3a1/Z1A6MU+bttEpoffen2v2woGtT70IVVuMdIwq+vvs+Kb0jgDzwe323HjR+3tzhL5pHriQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FYWWJJ6m; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FYWWJJ6m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C22CAC4CED6; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=dURN9dIELtyC2m0Zlh5rzANJ1Ev1GACofUTUaXFiXig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FYWWJJ6mf9ei+25Y/KLX5XAHvQZZrcfbkmbsbO5vWYyaJEWjWAUE3NiYmqzjgu2y+ N9SMt+ij9o6yFeEfumEkPcg9OoBzffxNRS+J7IS/c2YCZW4CQElb9eGQZkV20u1+uu wrOPmafBLg9Z6ayfJ1ze95ndteQhUPYFVHQL65t+XaUoN4pBE5raJpDksC1cNeFSfH mNzWFoJ9I3XNgS0x8ZbT2tNxmPJrrL6UrlKhd4Xrg37d7fmVr7Cz3vmikNnLpjDuwD o04QQpjxr1jAzWE4FDEsoHTBcpCZ+NhbMY9sBDlkQpOLK6NrxHV56GUUGcFmzc6+fY tk3ixUG26PRkg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeT-27wx; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Mauro Carvalho Chehab , Steven Toth , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 09/13] media: cx24116: prevent overflows on SNR calculus Date: Fri, 18 Oct 2024 07:53:11 +0200 Message-ID: X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" as reported by Coverity, if reading SNR registers fail, a negative number will be returned, causing an underflow when reading SNR registers. Prevent that. Fixes: 8953db793d5b ("V4L/DVB (9178): cx24116: Add module parameter to retu= rn SNR as ESNO.") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/cx24116.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-fron= tends/cx24116.c index 8b978a9f74a4..f5dd3a81725a 100644 --- a/drivers/media/dvb-frontends/cx24116.c +++ b/drivers/media/dvb-frontends/cx24116.c @@ -741,6 +741,7 @@ static int cx24116_read_snr_pct(struct dvb_frontend *fe= , u16 *snr) { struct cx24116_state *state =3D fe->demodulator_priv; u8 snr_reading; + int ret; static const u32 snr_tab[] =3D { /* 10 x Table (rounded up) */ 0x00000, 0x0199A, 0x03333, 0x04ccD, 0x06667, 0x08000, 0x0999A, 0x0b333, 0x0cccD, 0x0e667, @@ -749,7 +750,11 @@ static int cx24116_read_snr_pct(struct dvb_frontend *f= e, u16 *snr) =20 dprintk("%s()\n", __func__); =20 - snr_reading =3D cx24116_readreg(state, CX24116_REG_QUALITY0); + ret =3D cx24116_readreg(state, CX24116_REG_QUALITY0); + if (ret < 0) + return ret; + + snr_reading =3D ret; =20 if (snr_reading >=3D 0xa0 /* 100% */) *snr =3D 0xffff; --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2543E17C9F1; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=KzVajnWqqwqmR0jrMK9mXzqsYxoPmz2GCp/bC5bIABLYKT0LgteIs/iJke7lU2xj8ngGDTXLy/2d7fiiiQGalf38d4kdT2ns+Zk8mbVBvlmuO9y4EUxyeB75xSLFdEsDs4DY/HEroQWoArmJV3LOzoffS8cE3/Byo1qbDbd2vQ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=EslwWem0URL7HGO0wGR9dgXiEgLFlOjHPztcB3xbGHw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eP2eRr22ebD0jQfkFVcIZLeBC+GCL0g8SmU+6Lf8XSOG6yrnnvCSXJtsxFytgdGQrFxJN/mKOymKvFygEVpTGigUPz9J75gxRpNa2Y6EGjiI6M44OicgtNLyFabTVgoVPnW7TeNEzYjnjLHPDeLuYNdsNWqQ0VFbigSqZQ7w9Ng= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=s+4M4QAJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="s+4M4QAJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4E05C4CEC5; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=EslwWem0URL7HGO0wGR9dgXiEgLFlOjHPztcB3xbGHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s+4M4QAJ9NeQhp+U1BtM50Ej1Wpn9EQIGRoEmMNJ0LQmzUuBi2xb0Yzfm7yl1pbNN KpobAQpYDa/+z4rvECsuKGZwJNUnmZfxXUCsCcdnSI8m51E8t5kZh0au7EBAwROKZq HD2zU3YoBV4pOMvjoNjqrfNz8W4tUZ7Up1tjVa04YRtp+f6yQdgoRqR0/zLxf5vjju Y9AGHaqz3eCZ2lKZE1c7qqUWkOxFMiJ/1uRIxQ1O4E2hek79tmD3Z187AZUASG4sPj QbW3lWJxCj/PxbBOD6dpqoHdwSxcVzwk3U0TnNfG7wWq1Vbdc3ivbmEsria2udDBXD JkBzSCIAYN/Dg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005MeX-2Ehh; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH v2 10/13] media: adv7604: prevent underflow condition when reporting colorspace Date: Fri, 18 Oct 2024 07:53:12 +0200 Message-ID: X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" Currently, adv76xx_log_status() reads some date using io_read() which may return negative values. The current logic doesn't check such errors, causing colorspace to be reported on a wrong way at adv76xx_log_status(), as reported by Coverity. If I/O error happens there, print a different message, instead of reporting bogus messages to userspace. Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV760= 4 video decoder") Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Hans Verkuil --- drivers/media/i2c/adv7604.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c index 48230d5109f0..272945a878b3 100644 --- a/drivers/media/i2c/adv7604.c +++ b/drivers/media/i2c/adv7604.c @@ -2519,10 +2519,10 @@ static int adv76xx_log_status(struct v4l2_subdev *s= d) const struct adv76xx_chip_info *info =3D state->info; struct v4l2_dv_timings timings; struct stdi_readback stdi; - u8 reg_io_0x02 =3D io_read(sd, 0x02); + int ret; + u8 reg_io_0x02; u8 edid_enabled; u8 cable_det; - static const char * const csc_coeff_sel_rb[16] =3D { "bypassed", "YPbPr601 -> RGB", "reserved", "YPbPr709 -> RGB", "reserved", "RGB -> YPbPr601", "reserved", "RGB -> YPbPr709", @@ -2621,13 +2621,21 @@ static int adv76xx_log_status(struct v4l2_subdev *s= d) v4l2_info(sd, "-----Color space-----\n"); v4l2_info(sd, "RGB quantization range ctrl: %s\n", rgb_quantization_range_txt[state->rgb_quantization_range]); - v4l2_info(sd, "Input color space: %s\n", - input_color_space_txt[reg_io_0x02 >> 4]); - v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", - (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", - (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? - "(16-235)" : "(0-255)", - (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); + + ret =3D io_read(sd, 0x02); + if (ret < 0) { + v4l2_info(sd, "Can't read Input/Output color space\n"); + } else { + reg_io_0x02 =3D ret; + + v4l2_info(sd, "Input color space: %s\n", + input_color_space_txt[reg_io_0x02 >> 4]); + v4l2_info(sd, "Output color space: %s %s, alt-gamma %s\n", + (reg_io_0x02 & 0x02) ? "RGB" : "YCbCr", + (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ? + "(16-235)" : "(0-255)", + (reg_io_0x02 & 0x08) ? "enabled" : "disabled"); + } v4l2_info(sd, "Color space conversion: %s\n", csc_coeff_sel_rb[cp_read(sd, info->cp_csc) >> 4]); =20 --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D606187FE3; Fri, 18 Oct 2024 05:53:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=gGvLiJSRee36odKdM8lab1TrnH3oWmskecsXjlH8g7/nE+BeyDDm+Cpm00f0jCQS08U5SWcQqohnylqD1OdOC7VsL6T+CdN4nBUyRstqJs6QhkSS+cGijCkCYv6BK32mR2vNAKbANgVJyGzqESRS3kWDkPJ+oryRjEPkqWBKA9Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=HfALoVly1ujnpj+hXBkW4Goy8KItNqyAYKrdPlBXqkY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LR33+Jx2zb9XXXYqNVuqIikevSFt2Zte7XjE53z/h6x7gL12PLmW9IPU8Fn5tpdJ44/o1i048oDJ7DUJ9vye0TMeaucRtfrtiGye74wzAonlbYVY1QISVhEY3d8pNJlTSucUnIwOWSFfr9YGgS/d3Seb+KRl1xJ09UjO0fgifQM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hoxGKoa8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hoxGKoa8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C70D2C4AF09; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=HfALoVly1ujnpj+hXBkW4Goy8KItNqyAYKrdPlBXqkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hoxGKoa8a8H4gQVzxUWJb8iJMT1OFvpl1Hzhhx7QSiUnV3OuNqTdN1Plloe3for+Y Aa8QPhkXSHwAKX6za4Ga5LDhBX9dlfLKPg2QEieRMo96hPyWUl3h7AKdY4qb0NyQ5h 0w6Ix5yR4lxPRtBeWV1lgjPLoOIkv0NYNBpj6kJ9Y3agfIZm/GofC+QXck0P6B4Ob7 9tw1nbMUoed9gR0CFxfyAoZPxvGb7DWxBKyg5vJdyfUem5eKctOPk2gpP+b7Etns7z ta0sN+d/e0zE6taF2IhNFFMImd2J7LElJa4BWV099zxxpyUxwq0zummD1EAFgcydpR N8G21WdGnR0zg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Meb-2LHs; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Manu Abraham , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 11/13] media: stb0899_algo: initialize cfr before using it Date: Fri, 18 Oct 2024 07:53:13 +0200 Message-ID: <010d5654f49b0b1e6e9d84a2f40acc0e54894ff3.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The loop at stb0899_search_carrier() starts with a random value for cfr, as reported by Coverity. Initialize it to zero, just like stb0899_dvbs_algo() to ensure that carrier search won't bail out. Fixes: 8bd135bab91f ("V4L/DVB (9375): Add STB0899 support") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/stb0899_algo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/stb0899_algo.c b/drivers/media/dvb= -frontends/stb0899_algo.c index df89c33dac23..40537c4ccb0d 100644 --- a/drivers/media/dvb-frontends/stb0899_algo.c +++ b/drivers/media/dvb-frontends/stb0899_algo.c @@ -269,7 +269,7 @@ static enum stb0899_status stb0899_search_carrier(struc= t stb0899_state *state) =20 short int derot_freq =3D 0, last_derot_freq =3D 0, derot_limit, next_loop= =3D 3; int index =3D 0; - u8 cfr[2]; + u8 cfr[2] =3D {0}; u8 reg; =20 internal->status =3D NOCARRIER; --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27EB317CA0B; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=rAX8q3x4gz3IsTE2W3UduHQCuHlRkavt7lCVel+iRslXUOtHw5s9l/ceQvGA1uwYgb0LKoNrnkoocR/ASL/cUv5qT8nxbmKme7BbHjw6dAPUjlchgbqT8YhApVIE2ewtGpwUI6mWmlCQNRxl6zhz+S0DPJyZcbge9vz5xNRSTjk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=0mACDK++z3gYpIXaJs1fswOXuXPX4SSUmn45ykw9UT4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=egQamZ7NLt7jmavOoZTz4Rm50479gHM2t044oCgh+NFMqYoW6azesL13JEIJZorusaUMkxQWfYwbGDh/F92vqXsqNbT0DlcRpUf9duDLS3q29+Ac38l0xjrd1t08Q474/ofxkAjvxP0E3JNNKViN1mvwOOyV3+8YatVDCd50SfE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=M3mLxixd; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="M3mLxixd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1F50C4CECF; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=0mACDK++z3gYpIXaJs1fswOXuXPX4SSUmn45ykw9UT4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M3mLxixdkL3zLYHqT+OhPE/LSE64zcD/p58v4ZhMT2MSNrYIhhISlDmfM1uR9vxy/ tBY/Ekr6JYlcNDV6sXIyLvLuOpYWPozDUEN2y78hrxfj0GSZh4U00Fs0QehiZq5FRn k4V7p/ZF0r2CvFxJzO53jAxNxMx4A1gfiQ0emlUPB+CtQ/paiMz825krSi4a3xV0Y2 g1vUghpH/Egv0N7Xejl+gIxGMIrGoh4qNIljLw+2hMfaNapQw4vhpQRynblSawkw9g QpiOiNvlKT8L7y6vCkCCu+I/YVtyDTQNBZaAbayHJR7aX3s0tD5XFjR+daa0cLcep5 pYc0nu3jGjjhw== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Mef-2Rt6; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH v2 12/13] media: cec: extron-da-hd-4k-plus: don't use -1 as an error code Date: Fri, 18 Oct 2024 07:53:14 +0200 Message-ID: <86725525d38f8c79897d646c55c3341559f62640.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" The logic at get_edid_tag_location() returns either an offset or an error condition. However, the error condition uses a non-standard "-1" value. This hits a Coverity bug, as Coverity assumes that positive values are underflow. While this is a false positive, returning error codes as -1 is an issue. So, instead, use -ENOENT to indicate that the tag was not found. Fixes: 056f2821b631 ("media: cec: extron-da-hd-4k-plus: add the Extron DA H= D 4K Plus CEC driver") Signed-off-by: Mauro Carvalho Chehab --- .../cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plu= s.c b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c index a526464af88c..7d03a36df5cf 100644 --- a/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c +++ b/drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c @@ -348,12 +348,12 @@ static int get_edid_tag_location(const u8 *edid, unsi= gned int size, =20 /* Return if not a CTA-861 extension block */ if (size < 256 || edid[0] !=3D 0x02 || edid[1] !=3D 0x03) - return -1; + return -ENOENT; =20 /* search tag */ d =3D edid[0x02] & 0x7f; if (d <=3D 4) - return -1; + return -ENOENT; =20 i =3D 0x04; end =3D 0x00 + d; @@ -371,7 +371,7 @@ static int get_edid_tag_location(const u8 *edid, unsign= ed int size, return offset + i; i +=3D len + 1; } while (i < end); - return -1; + return -ENOENT; } =20 static void extron_edid_crc(u8 *edid) --=20 2.47.0 From nobody Tue Nov 26 11:27:37 2024 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2985A17CA17; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; cv=none; b=nMtbo/I7n4nVqjDzgpXVhDhqWtKNw9ZEw/nKelRC2uY2dQqeyiknyjgg4ZjkgNT2eVKE62fdsqURtViuznx0X/Lo2WUCLyRrP5vlEBWsZ1L5R0rdQuoIMFr9SgeBP8nEZuLpV4shUFOT2m1PoW9RgmbncMXEXZRqIJseFas5tgs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729230807; c=relaxed/simple; bh=hh6XlP2FkrU4iOsCrEKk8cmtfbZFCQUlDjidB8N3EOU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=HTDDj4v1lt5gWEFD5yaAnebBww+sQX+fY+Ti57NpPIMvpsM+sJjlApVkkCTAkyTrGdxQHAPKdAK4p/OVe88YHbpNCXI38JDVl+82803TTL77NtJqfo10zaSH3Ao7cF3fDbeGoHrOdWGN+ACS2xIUqVC+JZKMgBe+JivVV8cdvZI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RwyXULlj; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RwyXULlj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B941CC4CED0; Fri, 18 Oct 2024 05:53:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1729230806; bh=hh6XlP2FkrU4iOsCrEKk8cmtfbZFCQUlDjidB8N3EOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RwyXULljLrWbKexuR5WtQqCEwRMJxftwfe8Sh/gCzRKeo5RD9L7LsH/qBhXA/tBuO cfCBu9zIvSAYU0FeHYUAPtkOWdJR+jadIqeY+IQwnUESbgj5kXK09KhYFSFQeYj1y5 fUc5Dp9QXQpxtcEmJqQiGL7dWtsogxtQpY703lI8DTnbcAmaOap1al510SyquhxOa0 e+cvCvNaLm88qfWx2414bkZlcyFWpSAIFQGLggHiUgtJx2qNZntM+vN48OQUxl6j45 qF2W3jNPg5RRP8pCCOUl2JpV8lnQIHOHRaxMYgDh98cSkZTMiq9OpKXC1OIVnU5j2X Jaj/urBTVGoPg== Received: from mchehab by mail.kernel.org with local (Exim 4.98) (envelope-from ) id 1t1fvQ-00000005Mej-2YXS; Fri, 18 Oct 2024 07:53:24 +0200 From: Mauro Carvalho Chehab To: Cc: Mauro Carvalho Chehab , Hans Verkuil , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2 13/13] media: pulse8-cec: fix data timestamp at pulse8_setup() Date: Fri, 18 Oct 2024 07:53:15 +0200 Message-ID: <8fbcb2e2d05bc394fd4e15d44cc78b531f69ee8f.1729230718.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab Content-Type: text/plain; charset="utf-8" As pointed by Coverity, there is a hidden overflow condition there. As date is signed and u8 is unsigned, doing: date =3D (data[0] << 24) With a value bigger than 07f will make all upper bits of date 0xffffffff. This can be demonstrated with this small code: typedef int64_t time64_t; typedef uint8_t u8; int main(void) { u8 data[] =3D { 0xde ,0xad , 0xbe, 0xef }; time64_t date; date =3D (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; printf("Invalid data =3D 0x%08lx\n", date); date =3D ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | da= ta[3]; printf("Expected data =3D 0x%08lx\n", date); return 0; } Fix it by converting the upper bit calculation to unsigned. Fixes: cea28e7a55e7 ("media: pulse8-cec: reorganize function order") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab --- drivers/media/cec/usb/pulse8/pulse8-cec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/= usb/pulse8/pulse8-cec.c index ba67587bd43e..171366fe3544 100644 --- a/drivers/media/cec/usb/pulse8/pulse8-cec.c +++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c @@ -685,7 +685,7 @@ static int pulse8_setup(struct pulse8 *pulse8, struct s= erio *serio, err =3D pulse8_send_and_wait(pulse8, cmd, 1, cmd[0], 4); if (err) return err; - date =3D (data[0] << 24) | (data[1] << 16) | (data[2] << 8) | data[3]; + date =3D ((unsigned)data[0] << 24) | (data[1] << 16) | (data[2] << 8) | d= ata[3]; dev_info(pulse8->dev, "Firmware build date %ptT\n", &date); =20 dev_dbg(pulse8->dev, "Persistent config:\n"); --=20 2.47.0