linux-stable/drivers/media
Linus Torvalds 0c511f926b media: m5mols: fix off-by-one loop termination error
[ Upstream commit efbcbb12ee ]

The __find_restype() function loops over the m5mols_default_ffmt[]
array, and the termination condition ends up being wrong: instead of
stopping when the iterator becomes the size of the array it traverses,
it stops after it has already overshot the array.

Now, in practice this doesn't likely matter, because the code will
always find the entry it looks for, and will thus return early and never
hit that last extra iteration.

But it turns out that clang will unroll the loop fully, because it has
only two iterations (well, three due to the off-by-one bug), and then
clang will end up just giving up in the middle of the loop unrolling
when it notices that the code walks past the end of the array.

And that made 'objtool' very unhappy indeed, because the generated code
just falls off the edge of the universe, and ends up falling through to
the next function, causing this warning:

   drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc()

Fix the loop ending condition.

Reported-by: Jens Axboe <axboe@kernel.dk>
Analyzed-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Analyzed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/
Fixes: bc125106f8 ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP")
Cc: HeungJun, Kim <riverful.kim@samsung.com>
Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:31:30 +01:00
..
cec media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE 2022-11-10 18:15:33 +01:00
common media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() 2022-12-14 11:37:19 +01:00
dvb-core media: dvb-core: Fix UAF due to refcount races at releasing 2023-01-12 11:58:56 +01:00
dvb-frontends media: stv0288: use explicitly signed char 2023-01-12 11:58:49 +01:00
firewire
i2c media: m5mols: fix off-by-one loop termination error 2023-03-22 13:31:30 +01:00
mc
mmc
pci media: ipu3-cio2: Fix PM runtime usage_count in driver unbind 2023-03-10 09:40:09 +01:00
platform media: imx-jpeg: Apply clk_bulk api instead of operating specific clk 2023-03-10 09:39:45 +01:00
radio media: si470x: Fix use-after-free in si470x_int_in_callback() 2022-12-31 13:14:43 +01:00
rc media: rc: gpio-ir-recv: add remove function 2023-03-17 08:49:02 +01:00
spi
test-drivers media: vimc: Fix wrong function called when vimc_init() fails 2022-12-31 13:14:12 +01:00
tuners
usb media: uvcvideo: Fix race condition with usb_kill_urb 2023-03-11 13:57:39 +01:00
v4l2-core media: v4l2-jpeg: ignore the unknown APP14 marker 2023-03-10 09:39:45 +01:00
Kconfig media: correct MEDIA_TEST_SUPPORT help text 2022-01-27 11:05:20 +01:00
Makefile