From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f53.google.com (mail-oo1-f53.google.com [209.85.161.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59D7813B7A3 for ; Sat, 27 Jun 2026 07:12:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782544365; cv=none; b=VIG5MYAIy8hOn8c8o3CNUL4TNMN8v9s9NEHzAWS1wTmHi+8ZiqWA9+THKhCPfDQq2ncIUXuu8hIVZY0fgZTA8UtoEWhQhGU00t/NKkeNEYrAWY2MuHwz37p88zidJCysVFYllP4wkj/dA4DS/ymAwFIwnNdjQBw1MVrd65W/vNI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782544365; c=relaxed/simple; bh=veKScsnSI/cq+JEBuwcC2Di+VqVYaYnc+3Q6iZR+xNo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=UZMrvlqEZTi4YRs8+SMeci36lRZ9ynZdTFN7RETQTMgEn70PyBlQzvL+ppXSjUmRda0YRB5w8BkWjjgBPThBHoR2ul7PYR4o24zAdmzKZxhy+gnfOh1zfrRGhnBZChM6SO/n+ILGQvPInqSLNCTzYwtESloJO2r0E+jF/adTJCg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BEevPt5x; arc=none smtp.client-ip=209.85.161.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BEevPt5x" Received: by mail-oo1-f53.google.com with SMTP id 006d021491bc7-6a149bfb2a8so387480eaf.2 for ; Sat, 27 Jun 2026 00:12:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782544363; x=1783149163; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=SpJ3MkO1MinfMbfKGuNU2NZ2kaTJwCDCK0TiolpPBcg=; b=BEevPt5x93SQudIJbAARyjm4TrgX7NaKvuLKDS8OZJ8H4Hi1Ly5UJkUZv9/8y2dKBE C7mx814HgsPbFQ/hPKMurJNySfgfFdQoaKCQW1HuwY1DYtigEbgEJE+w2XMIzGmZ2Iur TCFmpk9gK3NRy4NpwudOTtpiLzcXA5ZSKoh1/PaVlEFE18zkxhvG5zKRvfK7D3PnNJxZ XhO63DuSzSwrXYJXrlLL0UFIt3Hqll5k1ZPKwL7WVgL5ga2tyzpKqcbB67OeeMkmDddQ fUuefpfbO05zH9JI2GjlC/LiJ38CbyF/4SH80/Oba3DZPoc+QQh+gFiOoIoRTXJS6Np+ eCTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782544363; x=1783149163; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=SpJ3MkO1MinfMbfKGuNU2NZ2kaTJwCDCK0TiolpPBcg=; b=ViycCtJg3BOERwhhYknCj1RDhcgK6q9LdDNrEneEbxHgv9hdMfyXH6UlRXX3DIzTBc 3Q/sEQWAaMzPl727Zys9cKWIJIq4l8rCmYJq9B1MD98csGqamNRXBvlYOa7Lc7Fs9R11 /ljRPyeu2BYtTe42wwdnjYO3JRuYr/I3BH4nmvRBtGGKlPkKP8jHnP8ZFTS9xqePj07n W3IQn1Pn050evb2BOvr4mzY05tIZMF5SxGKNIuOybuzgInRJrfj5ntGMbvm6toC/+NOR tDSahRoKc0GWFyT7Uur9iSEku4QqGhwKrHDYT6paDt18U5PDkCJJM//jdrZInsDIePJe VMgQ== X-Forwarded-Encrypted: i=1; AFNElJ927IwKFR/na7kjUkStW/4BkbwLqI0zhFt8m2hI9UsW2CUHAMzq4JUyI4z2jquIECcGBoSJvqbupOfCt1c=@vger.kernel.org X-Gm-Message-State: AOJu0YzPVtTNd2N6nvngzKImuTSCAxsZh6NrPgDkMKLNGEcFW4pxyQiJ aJp4GRHL/+nWR8CQVsaS4M0zkSl9DrHx1wnV+zPT1TIgG9Oo1XFe2tnswpda5AAl X-Gm-Gg: AfdE7ckp9s68jauwXbO6HFJ5ONoP2odHBt3ZJNW3aD4ck328ugnxjYaeYpU1SL+jdNB gD8VC81+td/0M10SMcD4DwK7PPsbUMDJHzJMcNPEbUOlXk8L/ko70B5Z7L1pJ4kxuzio4Wl42Nq jDbS57HW9osPjB6V0LkWShkz8nzH/AbT4Yu5uqvJGrLr/u543UzFuI8ggSQXSMKKnrFeLnFmhW2 j2yOZceTuhnFqHhr/DdV5k4/ydXlIKSXAJaB7m0EW0Heh3i/sEWa/Cn+x5oiBUTq6r0JPJIIHZL Subr2bKrLADy4/NemJXbars+y7LLTose+BZF6rQsDkOHqQBMC54sqXSpbpAffWZ6OkIRV7msgaL xhM/S78et+SJ4GX6IEUnrH/qJ9xIoKyEwQvHTh23GlktNDUynUy4is+riSdS2HZ3jTpoNYHSNMJ jd0yU8 X-Received: by 2002:a05:6820:f00d:b0:6a1:57aa:289d with SMTP id 006d021491bc7-6a157aa2ae7mr1248986eaf.30.1782544363315; Sat, 27 Jun 2026 00:12:43 -0700 (PDT) Received: from localhost ([74.80.182.98]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-6a1415266aesm3058413eaf.15.2026.06.27.00.12.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 Jun 2026 00:12:41 -0700 (PDT) Date: Sat, 27 Jun 2026 10:12:34 +0300 From: Dan Carpenter To: Doruk Tan Ozturk Cc: Hans de Goede , Andy Shevchenko , Mauro Carvalho Chehab , Greg Kroah-Hartman , Sakari Ailus , linux-media@vger.kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [PATCH] media: atomisp: reject frame dimensions that overflow the size calculation Message-ID: References: <20260627065556.88673-1-doruk@0sec.ai> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260627065556.88673-1-doruk@0sec.ai> On Sat, Jun 27, 2026 at 08:55:56AM +0200, Doruk Tan Ozturk wrote: > @@ -106,10 +107,30 @@ int ia_css_frame_allocate(struct ia_css_frame **frame, > unsigned int raw_bit_depth) > { > int err = 0; > + u32 bytes; > > if (!frame || width == 0 || height == 0) > return -EINVAL; > > + /* > + * The frame_init_*_planes() helpers compute frame->data_bytes (a u32) > + * as width/padded_width * height * bytes-per-pixel * plane-count using > + * unmodulated unsigned arithmetic, with no overflow check, and the > + * result is then handed to hmm_alloc(). width, height and padded_width > + * are user-controlled (e.g. via the v4l2_framebuffer ioctl path in > + * atomisp_v4l2_framebuffer_to_css_frame()). A large width/height pair > + * makes the size calculation wrap, producing an undersized hmm buffer > + * that a subsequent copy then overflows. > + * > + * Reject up front any dimensions whose worst-case byte count cannot be > + * represented in the u32 data_bytes field. The factor 16 conservatively > + * bounds the largest per-pixel multiplier across all supported formats > + * (up to 6 planes / 3x RGB planes with up to 4 bytes per element). > + */ AI likes to add comments to every line which it changes. That information is already there in the commit message. Everyone knows what check_mul_overflow() is for. It's like the ToS when you buy software, there might be some interesting information in there but we'll never know because it's too much. The same thing applies to comments. Don't comment on things which are obvious. (You might wonder why, if this is obvious, wasn't it done in the original code. drivers/staging/ is for code which is obviously bad). regards, dan carpenter > + if (check_mul_overflow(max(width, padded_width), height, &bytes) || > + check_mul_overflow(bytes, 16u, &bytes)) > + return -EINVAL; > + > ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, > "ia_css_frame_allocate() enter: width=%d, height=%d, format=%d, padded_width=%d, raw_bit_depth=%d\n", > width, height, format, padded_width, raw_bit_depth); > -- > 2.53.0