* [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
@ 2026-08-21 21:27 David Carlier
0 siblings, 0 replies; 4+ messages in thread
From: David Carlier @ 2026-08-21 21:27 UTC (permalink / raw)
To: Keke Li; +Cc: Jacopo Mondi, Mauro Carvalho Chehab, linux-media, linux-kernel
The AWB, AE and AF coordinate loops bound themselves by
max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
taken verbatim from userspace, so the bound reaches 256 while the
coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
placed last in a full payload reads 474 bytes past the parameters
buffer.
Clamp the point count to the array size, as the zone weight loops
already do.
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index ae0777a20bda..f2396e2c6640 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AWB_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
@@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AE_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
@@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AF_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
--
2.55.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
@ 2026-08-21 21:27 David Carlier
0 siblings, 0 replies; 4+ messages in thread
From: David Carlier @ 2026-08-21 21:27 UTC (permalink / raw)
To: Keke Li; +Cc: Jacopo Mondi, Mauro Carvalho Chehab, linux-media, linux-kernel
The AWB, AE and AF coordinate loops bound themselves by
max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
taken verbatim from userspace, so the bound reaches 256 while the
coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
placed last in a full payload reads 474 bytes past the parameters
buffer.
Clamp the point count to the array size, as the zone weight loops
already do.
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index ae0777a20bda..f2396e2c6640 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AWB_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
@@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AE_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
@@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AF_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
--
2.55.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
@ 2026-08-21 21:28 David Carlier
2026-08-28 1:55 ` Keke Li
0 siblings, 1 reply; 4+ messages in thread
From: David Carlier @ 2026-08-21 21:28 UTC (permalink / raw)
To: Keke Li; +Cc: Jacopo Mondi, linux-media, linux-kernel, David Carlier, stable
The AWB, AE and AF coordinate loops bound themselves by
max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
taken verbatim from userspace, so the bound reaches 256 while the
coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
placed last in a full payload reads 474 bytes past the parameters
buffer.
Clamp the point count to the array size, as the zone weight loops
already do.
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index ae0777a20bda..f2396e2c6640 100644
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AWB_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
@@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AE_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
@@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
unsigned int max_point_num;
/* The number of points is one more than the number of edges */
- max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
+ max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
+ C3_ISP_AF_MAX_PT_NUM);
/* Set the index address to 0 position */
c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
--
2.55.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates
2026-08-21 21:28 David Carlier
@ 2026-08-28 1:55 ` Keke Li
0 siblings, 0 replies; 4+ messages in thread
From: Keke Li @ 2026-08-28 1:55 UTC (permalink / raw)
To: David Carlier; +Cc: Jacopo Mondi, linux-media, linux-kernel, stable
Hi David
Thanks for your patch.
On 8/22/26 05:28, David Carlier wrote:
> [You don't often get email from devnexen@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> [ EXTERNAL EMAIL ]
>
> The AWB, AE and AF coordinate loops bound themselves by
> max(horiz_zones_num, vert_zones_num) + 1. Both counts are u8 values
> taken verbatim from userspace, so the bound reaches 256 while the
> coordinate arrays hold 18 entries (AE, AF) or 33 (AWB). An AF block
> placed last in a full payload reads 474 bytes past the parameters
> buffer.
>
> Clamp the point count to the array size, as the zone weight loops
> already do.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Keke Li <keke.li@amlogic.com>
> ---
> drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> index ae0777a20bda..f2396e2c6640 100644
> --- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> +++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> @@ -139,7 +139,8 @@ static void c3_isp_params_awb_cood(struct c3_isp_device *isp,
> unsigned int max_point_num;
>
> /* The number of points is one more than the number of edges */
> - max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
> + max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
> + C3_ISP_AWB_MAX_PT_NUM);
>
> /* Set the index address to 0 position */
> c3_isp_write(isp, ISP_AWB_IDX_ADDR, 0);
> @@ -258,7 +259,8 @@ static void c3_isp_params_ae_cood(struct c3_isp_device *isp,
> unsigned int max_point_num;
>
> /* The number of points is one more than the number of edges */
> - max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
> + max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
> + C3_ISP_AE_MAX_PT_NUM);
>
> /* Set the index address to 0 position */
> c3_isp_write(isp, ISP_AE_IDX_ADDR, 0);
> @@ -316,7 +318,8 @@ static void c3_isp_params_af_cood(struct c3_isp_device *isp,
> unsigned int max_point_num;
>
> /* The number of points is one more than the number of edges */
> - max_point_num = max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1;
> + max_point_num = min(max(cfg->horiz_zones_num, cfg->vert_zones_num) + 1,
> + C3_ISP_AF_MAX_PT_NUM);
>
> /* Set the index address to 0 position */
> c3_isp_write(isp, ISP_AF_IDX_ADDR, 0);
> --
> 2.55.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-28 1:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-21 21:27 [PATCH] media: amlogic-c3: Fix out-of-bounds read of metering zone coordinates David Carlier
2026-08-21 21:27 David Carlier
2026-08-21 21:28 David Carlier
2026-08-28 1:55 ` Keke Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®