linux/drivers/media
Linus Torvalds 0c511f926b media: m5mols: fix off-by-one loop termination error
[ Upstream commit efbcbb12ee ]

The __find_restype() function loops over the m5mols_default_ffmt[]
array, and the termination condition ends up being wrong: instead of
stopping when the iterator becomes the size of the array it traverses,
it stops after it has already overshot the array.

Now, in practice this doesn't likely matter, because the code will
always find the entry it looks for, and will thus return early and never
hit that last extra iteration.

But it turns out that clang will unroll the loop fully, because it has
only two iterations (well, three due to the off-by-one bug), and then
clang will end up just giving up in the middle of the loop unrolling
when it notices that the code walks past the end of the array.

And that made 'objtool' very unhappy indeed, because the generated code
just falls off the edge of the universe, and ends up falling through to
the next function, causing this warning:

   drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc()

Fix the loop ending condition.

Reported-by: Jens Axboe <axboe@kernel.dk>
Analyzed-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Analyzed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/
Fixes: bc125106f8 ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP")
Cc: HeungJun, Kim <riverful.kim@samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-03-22 13:31:30 +01:00
..
cec media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE 2022-11-10 18:15:33 +01:00
common media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() 2022-12-14 11:37:19 +01:00
dvb-core media: dvb-core: Fix UAF due to refcount races at releasing 2023-01-12 11:58:56 +01:00
dvb-frontends media: stv0288: use explicitly signed char 2023-01-12 11:58:49 +01:00
firewire media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() 2021-11-06 14:13:30 +01:00
i2c media: m5mols: fix off-by-one loop termination error 2023-03-22 13:31:30 +01:00
mc media: mc-device.c: use DEVICE_ATTR_RO() helper macro 2021-08-04 14:43:50 +02:00
mmc media updates for v5.8-rc1 2020-06-03 20:59:38 -07:00
pci media: ipu3-cio2: Fix PM runtime usage_count in driver unbind 2023-03-10 09:40:09 +01:00
platform media: imx-jpeg: Apply clk_bulk api instead of operating specific clk 2023-03-10 09:39:45 +01:00
radio media: si470x: Fix use-after-free in si470x_int_in_callback() 2022-12-31 13:14:43 +01:00
rc media: rc: gpio-ir-recv: add remove function 2023-03-17 08:49:02 +01:00
spi media: cxd2880-spi: Fix a null pointer dereference on error handling path 2021-11-18 19:16:27 +01:00
test-drivers media: vimc: Fix wrong function called when vimc_init() fails 2022-12-31 13:14:12 +01:00
tuners media: msi001: fix possible null-ptr-deref in msi001_probe() 2022-01-27 11:03:36 +01:00
usb media: uvcvideo: Fix race condition with usb_kill_urb 2023-03-11 13:57:39 +01:00
v4l2-core media: v4l2-jpeg: ignore the unknown APP14 marker 2023-03-10 09:39:45 +01:00
Kconfig media: correct MEDIA_TEST_SUPPORT help text 2022-01-27 11:05:20 +01:00
Makefile media: media/test_drivers: rename to test-drivers 2020-04-16 10:38:31 +02:00