On Wed, 13 Jan 2021 at 06:08, Tomi Valkeinen tomi.valkeinen@ideasonboard.com wrote:
On 13/01/2021 11:00, Tomi Valkeinen wrote:
The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be of size cal_v4l2_async_subdev, otherwise access to cal_v4l2_async_subdev->phy will go to unallocated memory.
Fixes: 8fcb7576ad19 ("media: ti-vpe: cal: Allow multiple contexts per subdev notifier") Signed-off-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com
Ah, I forgot to add:
Cc: stable@vger.kernel.org # 5.9+
Nice catch. I missed users of v4l2_async_notifier_add_fwnode_subdev in my recent cleanup series.
Reviewed-by: Ezequiel Garcia ezequiel@collabora.com
Thanks, Ezequiel
drivers/media/platform/ti-vpe/cal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c index 59a0266b1f39..2eef245c31a1 100644 --- a/drivers/media/platform/ti-vpe/cal.c +++ b/drivers/media/platform/ti-vpe/cal.c @@ -406,7 +406,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data) */
struct cal_v4l2_async_subdev {
struct v4l2_async_subdev asd;
struct v4l2_async_subdev asd; /* Must be first */ struct cal_camerarx *phy;};
@@ -472,7 +472,7 @@ static int cal_async_notifier_register(struct cal_dev *cal) fwnode = of_fwnode_handle(phy->sensor_node); asd = v4l2_async_notifier_add_fwnode_subdev(&cal->notifier, fwnode,
sizeof(*asd));
sizeof(*casd)); if (IS_ERR(asd)) { phy_err(phy, "Failed to add subdev to notifier\n"); ret = PTR_ERR(asd);