diff options
| author | Hans de Goede <hdegoede@redhat.com> | 2023-07-05 23:29:54 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-09-13 09:53:41 +0200 |
| commit | de031db3708f356a52eca21ebf7e7da944f2dd92 (patch) | |
| tree | a6e83501b04d3c796d2ad3d9485d3e36b04ebfa9 | |
| parent | 9c96bea0e5f4adabcf8359eb54d67abd71d74be2 (diff) | |
| download | linux-stable-de031db3708f356a52eca21ebf7e7da944f2dd92.tar.gz linux-stable-de031db3708f356a52eca21ebf7e7da944f2dd92.tar.bz2 linux-stable-de031db3708f356a52eca21ebf7e7da944f2dd92.zip | |
media: ipu-bridge: Do not use on stack memory for software_node.name field
[ Upstream commit 11e0a7c8e04ee5f406f2baa27761746cbedcfa11 ]
Commit 567f97bd381f ("media: ipu3-cio2: support multiple sensors and VCMs
with same HID") introduced an on stack vcm_name and then uses this for
the name field of the software_node struct used for the vcm.
But the software_node struct is much longer lived then the current
stack-frame, so this is no good.
Instead extend the ipu_node_names struct with an extra field to store
the vcm software_node name and use that.
Note this also changes the length of the allocated buffer from
ACPI_ID_LEN + 4 to 16. the name is filled with "<ipu_vcm_types[x]>-%u"
where ipu_vcm_types[x] is not an ACPI_ID. The maximum length of
the strings in the ipu_vcm_types[] array is 11 + 5 bytes for "-255\0"
means 16 bytes are needed in the worst case scenario.
Fixes: 567f97bd381f ("media: ipu3-cio2: support multiple sensors and VCMs with same HID")
Cc: Bingbu Cao <bingbu.cao@intel.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/media/pci/intel/ipu-bridge.c | 7 | ||||
| -rw-r--r-- | drivers/media/pci/intel/ipu-bridge.h | 1 |
2 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/pci/intel/ipu-bridge.c b/drivers/media/pci/intel/ipu-bridge.c index 38fa756602bc..88490ea304de 100644 --- a/drivers/media/pci/intel/ipu-bridge.c +++ b/drivers/media/pci/intel/ipu-bridge.c @@ -220,7 +220,6 @@ static void ipu_bridge_create_connection_swnodes(struct ipu_bridge *bridge, struct ipu_sensor *sensor) { struct software_node *nodes = sensor->swnodes; - char vcm_name[ACPI_ID_LEN + 4]; ipu_bridge_init_swnode_names(sensor); @@ -240,10 +239,10 @@ static void ipu_bridge_create_connection_swnodes(struct ipu_bridge *bridge, sensor->ipu_properties); if (sensor->ssdb.vcmtype) { /* append ssdb.link to distinguish VCM nodes with same HID */ - snprintf(vcm_name, sizeof(vcm_name), "%s-%u", - ipu_vcm_types[sensor->ssdb.vcmtype - 1], + snprintf(sensor->node_names.vcm, sizeof(sensor->node_names.vcm), + "%s-%u", ipu_vcm_types[sensor->ssdb.vcmtype - 1], sensor->ssdb.link); - nodes[SWNODE_VCM] = NODE_VCM(vcm_name); + nodes[SWNODE_VCM] = NODE_VCM(sensor->node_names.vcm); } ipu_bridge_init_swnode_group(sensor); diff --git a/drivers/media/pci/intel/ipu-bridge.h b/drivers/media/pci/intel/ipu-bridge.h index d35b5f30ac3f..1ff0b2d04d92 100644 --- a/drivers/media/pci/intel/ipu-bridge.h +++ b/drivers/media/pci/intel/ipu-bridge.h @@ -104,6 +104,7 @@ struct ipu_node_names { char port[7]; char endpoint[11]; char remote_port[7]; + char vcm[16]; }; struct ipu_sensor_config { |