diff options
| author | Luca Ceresoli <luca@lucaceresoli.net> | 2018-11-26 11:35:07 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-09 17:38:47 +0100 |
| commit | 257ad26e7e98c7ec60692f7efa704076a5d9f7a7 (patch) | |
| tree | 72b541e198d597b6bb8100aadc774dc06dad33a7 /drivers/media | |
| parent | 7ce31f635b23fb68555a6f3fc2c36789d70fdf62 (diff) | |
| download | linux-stable-257ad26e7e98c7ec60692f7efa704076a5d9f7a7.tar.gz linux-stable-257ad26e7e98c7ec60692f7efa704076a5d9f7a7.tar.bz2 linux-stable-257ad26e7e98c7ec60692f7efa704076a5d9f7a7.zip | |
media: imx274: fix stack corruption in imx274_read_reg
commit cea8c0077d6cf3a0cea2f18a8e914af78d46b2ff upstream.
imx274_read_reg() takes a u8 pointer ("reg") and casts it to pass it
to regmap_read(), which takes an unsigned int pointer. This results in
a corrupted stack and random crashes.
Fixes: 0985dd306f72 ("media: imx274: V4l2 driver for Sony imx274 CMOS sensor")
Cc: stable@vger.kernel.org # for 4.15 and up
Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/i2c/imx274.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/i2c/imx274.c b/drivers/media/i2c/imx274.c index f8c70f1a34fe..8cc3bdb7f608 100644 --- a/drivers/media/i2c/imx274.c +++ b/drivers/media/i2c/imx274.c @@ -636,16 +636,19 @@ static int imx274_write_table(struct stimx274 *priv, const struct reg_8 table[]) static inline int imx274_read_reg(struct stimx274 *priv, u16 addr, u8 *val) { + unsigned int uint_val; int err; - err = regmap_read(priv->regmap, addr, (unsigned int *)val); + err = regmap_read(priv->regmap, addr, &uint_val); if (err) dev_err(&priv->client->dev, "%s : i2c read failed, addr = %x\n", __func__, addr); else dev_dbg(&priv->client->dev, "%s : addr 0x%x, val=0x%x\n", __func__, - addr, *val); + addr, uint_val); + + *val = uint_val; return err; } |