From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752164AbdIMJZ4 (ORCPT ); Wed, 13 Sep 2017 05:25:56 -0400 Received: from mailout4.samsung.com ([203.254.224.34]:15017 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751610AbdIMJZy (ORCPT ); Wed, 13 Sep 2017 05:25:54 -0400 X-AuditID: b6c32a35-f798c6d000005940-df-59b8f99fc67d Subject: Re: [PATCH] [media] s3c-camif: fix out-of-bounds array access To: Arnd Bergmann Cc: Sylwester Nawrocki , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org From: Sylwester Nawrocki Message-id: <4355b20a-504c-4e83-92c8-049e6c6d6a5f@samsung.com> Date: Wed, 13 Sep 2017 11:25:47 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-version: 1.0 In-reply-to: <20170912200932.3634089-1-arnd@arndb.de> Content-type: text/plain; charset="utf-8" Content-language: en-GB Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEKsWRmVeSWpSXmKPExsWy7bCmvu6CnzsiDXq+Mln8nXSM3eLyrjls Fj0btrJazDi/j8li2aY/TBbtT18yO7B5/P41idFj06pONo/Pm+QCmKO4bFJSczLLUov07RK4 MiYs6GMs6BGsmPxuKlsDYztfFyMnh4SAicT/PdvZIWwxiQv31rN1MXJxCAnsYJRYcusOE4Tz nVHi9IcXTDAdB7c9ZoZI7GaUOLFpF5RzH8jZ8ResSljATeL/5Otgc0UEFCWmvngGVsQM0nFg xnpWkASbgKFE79E+RhCbV8BOYsuqlcwgNouAqsS2Y3NYQGxRgQiJbd9nsEHUCEr8mHwPLM4p YCqx8uB+sHpmAU2JF18msUDY4hLH7t9khLDlJTaveQu2WEJgD5vEnGkfGSF+cJFon7wL6mth iVfHtwDZHEC2tMSlo7YQ9f1A36xpZoRwZjBK3GmfAA0Aa4nDxy+yQmzgk3j3tYcVoplXoqNN CKLEQ+LPostQYUeJxl8CkBDqYJS4cmsC8wRG+VlI/pmF5IdZSH6YheSHBYwsqxjFUguKc9NT iw0LDPWKE3OLS/PS9ZLzczcxglOKlukOxinnfA4xCnAwKvHwBtzaHinEmlhWXJl7iFGCg1lJ hPfYpx2RQrwpiZVVqUX58UWlOanFhxilOViUxHlF11+LEBJITyxJzU5NLUgtgskycXBKNTCG RHAGrrmnO+315L0zr5VekZzX8CNC0+gEb94PX1/uS7vWrRfn2f5M4Z3an9nFu+ZzSdzh/qlf 78ugMaVoSsz9q9f9fh4WDdz+J9ZTKFjBc9+5T7YWyny2P1x7vH5XPJt37Z9Y7Z2On4UzXK6F bH0q0Xxb/vmOG0LXDgV1WH+8vW2adsJu38tvlFiKMxINtZiLihMBFtww3yUDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrDLMWRmVeSWpSXmKPExsVy+t9jAd35P3dEGrx7qWXxd9IxdovLu+aw WfRs2MpqMeP8PiaLZZv+MFm0P33J7MDm8fvXJEaPTas62Tw+b5ILYI7isklJzcksSy3St0vg ypiwoI+xoEewYvK7qWwNjO18XYycHBICJhIHtz1m7mLk4hAS2MkosfbQXUYI5yGjxI9D91hB qoQF3CT+T77ODmKLCChKTH3xDKyDWWA3o8TCrj4mkIQQ0Kg9/+cwg9hsAoYSvUf7GEFsXgE7 iS2rVoLFWQRUJbYdm8MCYosKREj0vb3MDlEjKPFj8j2wOKeAqcTKg/uB6jmAFqhLTJmSCxJm FhCXOHb/JiOELS+xec1b5gmMArOQdM9C6JiFpGMWko4FjCyrGCVTC4pz03OLjQoM81LL9YoT c4tL89L1kvNzNzECw3zbYa2+HYz3l8QfYhTgYFTi4V1xZ3ukEGtiWXFl7iFGCQ5mJRHeY592 RArxpiRWVqUW5ccXleakFh9ilOZgURLnzeybESkkkJ5YkpqdmlqQWgSTZeLglGpgXG4VOenE oUW6AXVXbvPxZLyb0atcs69IwTbK116o437PxG3iSuwCq92ev5YTuGfd+Tqpmrth+9K06Cui mctWfdr6QqHs8VTJdSuazcUdXs2/LFH/xPjOPdfFIp32rJcFtrM+mbHgyJSEkika3SEPVn6Y 4/mr/Y8MX5xnl1WvqOy7pU86ajP/KrEUZyQaajEXFScCALi6nR5vAgAA X-CMS-MailID: 20170913092551epcas1p4f84e118f364f605cb5cc6b8b669ac095 X-Msg-Generator: CA X-Sender-IP: 182.195.42.142 X-Local-Sender: =?UTF-8?B?U3lsd2VzdGVyIE5hd3JvY2tpG1NSUE9MLUtlcm5lbCAoVFAp?= =?UTF-8?B?G+yCvOyEseyghOyekBtTZW5pb3IgU29mdHdhcmUgRW5naW5lZXI=?= X-Global-Sender: =?UTF-8?B?U3lsd2VzdGVyIE5hd3JvY2tpG1NSUE9MLUtlcm5lbCAoVFAp?= =?UTF-8?B?G1NhbXN1bmcgRWxlY3Ryb25pY3MbU2VuaW9yIFNvZnR3YXJlIEVuZ2luZWVy?= X-Sender-Code: =?UTF-8?B?QzEwG0VIURtDMTBDRDAyQ0QwMjczOTI=?= CMS-TYPE: 101P X-CMS-RootMailID: 20170913092551epcas1p4f84e118f364f605cb5cc6b8b669ac095 X-RootMTR: 20170913092551epcas1p4f84e118f364f605cb5cc6b8b669ac095 References: <20170912200932.3634089-1-arnd@arndb.de> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/12/2017 10:09 PM, Arnd Bergmann wrote: > While experimenting with older compiler versions, I ran > into a warning that no longer shows up on gcc-4.8 or newer: > > drivers/media/platform/s3c-camif/camif-capture.c: In function '__camif_subdev_try_format': > drivers/media/platform/s3c-camif/camif-capture.c:1265:25: error: array subscript is below array bounds > > This is an off-by-one bug, leading to an access before the start of the > array, while newer compilers silently assume this undefined behavior > cannot happen and leave the loop at index 0 if no other entry matches. > > Since the code is not only wrong, but also has no effect besides the > out-of-bounds access, this patch just removes it. > > I found an existing gcc bug for it and added a reduced version > of the function there. > > Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69249#c3 > Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface") > Signed-off-by: Arnd Bergmann > --- > drivers/media/platform/s3c-camif/camif-capture.c | 7 ------- > 1 file changed, 7 deletions(-) > > diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c > index 25c7a7d42292..c6921f6a5a6a 100644 > --- a/drivers/media/platform/s3c-camif/camif-capture.c > +++ b/drivers/media/platform/s3c-camif/camif-capture.c > @@ -1256,17 +1256,10 @@ static void __camif_subdev_try_format(struct camif_dev *camif, > { > const struct s3c_camif_variant *variant = camif->variant; > const struct vp_pix_limits *pix_lim; > - int i = ARRAY_SIZE(camif_mbus_formats); > > /* FIXME: constraints against codec or preview path ? */ > pix_lim = &variant->vp_pix_limits[VP_CODEC]; > > - while (i-- >= 0) > - if (camif_mbus_formats[i] == mf->code) > - break; > - > - mf->code = camif_mbus_formats[i]; Interesting finding... the function needs to ensure mf->code is set to one of supported values by the driver, so instead of removing how about changing the above line to: if (i < 0) mf->code = camif_mbus_formats[0]; ? -- Thanks, Sylwester