From patchwork Tue Jan 12 20:23:28 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: michael X-Patchwork-Id: 72439 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.2) with ESMTP id o0CKNgrK003468 for ; Tue, 12 Jan 2010 20:23:42 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753728Ab0ALUXl (ORCPT ); Tue, 12 Jan 2010 15:23:41 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754047Ab0ALUXk (ORCPT ); Tue, 12 Jan 2010 15:23:40 -0500 Received: from ms01.sssup.it ([193.205.80.99]:39234 "EHLO sssup.it" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754038Ab0ALUXj (ORCPT ); Tue, 12 Jan 2010 15:23:39 -0500 Received: from [193.205.82.7] (HELO gandalf.sssup.it) by sssup.it (CommuniGate Pro SMTP 4.1.8) with ESMTP-TLS id 56852236; Tue, 12 Jan 2010 21:21:32 +0100 Received: from [10.30.3.179] (vpn179.retis [10.30.3.179]) by gandalf.sssup.it (8.12.10/8.12.10) with ESMTP id o0CKNTeI005531 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 12 Jan 2010 21:23:34 +0100 Message-ID: <4B4CDA40.9030102@panicking.kicks-ass.org> Date: Tue, 12 Jan 2010 21:23:28 +0100 From: Michael Trimarchi User-Agent: Mozilla-Thunderbird 2.0.0.22 (X11/20090707) MIME-Version: 1.0 To: Sakari Ailus , Sergio Aguirre CC: "linux-media@vger.kernel.org" Subject: [RFC PATCH] Fix and invalid array indexing in isp_csi2_complexio_lanes_config Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Fix and invalid array indexing when refcfg->data[i].pos is equal to 0. The code access an invalid location. Signed-off-by: Michael Trimarchi cc: akari Ailus cc: Sergio Aguirre --- diff --git a/drivers/media/video/isp/ispcsi2.c b/drivers/media/video/isp/ispcsi2.c index fb0f44f..cc8fa39 100644 --- a/drivers/media/video/isp/ispcsi2.c +++ b/drivers/media/video/isp/ispcsi2.c @@ -85,8 +85,10 @@ int isp_csi2_complexio_lanes_config(struct isp_csi2_device *isp_csi2, " parameters for data lane #%d\n", i); goto err_einval; } - if (pos_occupied[reqcfg->data[i].pos - 1] && - reqcfg->data[i].pos > 0) { + if (!reqcfg->data[i].pos) + continue; + + if (pos_occupied[reqcfg->data[i].pos - 1]) { printk(KERN_ERR "Lane #%d already occupied\n", reqcfg->data[i].pos); goto err_einval;