From patchwork Wed Jul 3 11:59:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Verkuil X-Patchwork-Id: 13722142 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E440173348; Wed, 3 Jul 2024 11:59:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720007961; cv=none; b=ImHSVraRQcivg9VwW4M+CS4VY0THNzSEMelUsTKwmqh22de1HvIaEiWUTzkAvvG3LbF8kUuz7lXzgdXpk7LPkSB3tDm6H0pacPaV98H9nfEBpcxLOmq1fRPtmbWBX8NrkARC/Ju/Y+owuDF6xI5LOlK8qwIxCUst+dHiWqBgsP4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720007961; c=relaxed/simple; bh=Je7wS9RpqxSacD0i2REqoriVrEW8W9Ly+p/tTqcEIE0=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=MqcIsuXgechAjgM7KgQpsgTKdPEkBrp4WDlH6/OqheYEKiYH4okBGj55IFtK0V14ag/wnmN3tx3U3M2zo9QGqAOKMVDeFDYDzJsMHbv/m+BUG9FZoy9DA5rUTrLXO7FZdKbQ8YHLzVo2vIH8Iz9qOqKK9JqVu0nQ/eYQeXpD/kE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33501C2BD10; Wed, 3 Jul 2024 11:59:18 +0000 (UTC) Message-ID: <2dea6faf-53f6-461a-809b-ec572357ad07@xs4all.nl> Date: Wed, 3 Jul 2024 13:59:16 +0200 Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US, nl To: Linux Media Mailing List Cc: Maxime Coquelin , Alexandre Torgue , Sakari Ailus , Alain Volmat , Hugues Fruchet , Linux Stable , "linux-stm32@st-md-mailman.stormreply.com" , linux-arm-kernel@lists.infradead.org, Linux Kernel From: Hans Verkuil Subject: [PATCH] media: stm32: dcmipp: correct error handling in, dcmipp_create_subdevs From: Alain Volmat Correct error handling within the dcmipp_create_subdevs by properly decrementing the i counter when releasing the subdevs. Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver") Cc: stable@vger.kernel.org Signed-off-by: Alain Volmat Signed-off-by: Hans Verkuil [hverkuil: correct the indices: it's [i], not [i - 1].] --- The original patch would cause a crash due to the incorrect indices in the statement after the while. Since 'i' can now become 0, so i - 1 would be a negative index access, which was obviously not the intention. I reverted the patch once I noticed this (better to hang in an infinite loop than to crash), but I want to get a proper fix in. Rather than waiting for that, I decided to just take the original patch from Alain, with just the indices fixed. --- drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c index 4acc3b90d03a..7f771ea49b78 100644 --- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c +++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-core.c @@ -202,8 +202,8 @@ static int dcmipp_create_subdevs(struct dcmipp_device *dcmipp) return 0; err_init_entity: - while (i > 0) - dcmipp->pipe_cfg->ents[i - 1].release(dcmipp->entity[i - 1]); + while (i-- > 0) + dcmipp->pipe_cfg->ents[i].release(dcmipp->entity[i]); return ret; }