xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: imx274: fix stack corruption in imx274_read_reg

Browse Source 
imx274_read_reg() takes a u8 pointer ("reg") and casts it to pass it
to regmap_read(), which takes an unsigned int pointer. This results in
a corrupted stack and random crashes.

Fixes: 0985dd306f ("media: imx274: V4l2 driver for Sony imx274 CMOS sensor")

Cc: stable@vger.kernel.org # for 4.15 and up
Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
Luca Ceresoli
2018-11-26 11:35:07 -05:00
committed by Mauro Carvalho Chehab
parent ce6ebeacbe
commit cea8c0077d
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/media/i2c/imx274.c
View File

@@ -619,16 +619,19 @@ static int imx274_write_table(struct stimx274 *priv, const struct reg_8 table[])
static inline int imx274_read_reg(struct stimx274 *priv, u16 addr, u8 *val) static inline int imx274_read_reg(struct stimx274 *priv, u16 addr, u8 *val)
{ {
unsigned int uint_val;
int err; int err;
err = regmap_read(priv->regmap, addr, (unsigned int *)val); err = regmap_read(priv->regmap, addr, &uint_val);
if (err) if (err)
dev_err(&priv->client->dev, dev_err(&priv->client->dev,
"%s : i2c read failed, addr = %x\n", __func__, addr); "%s : i2c read failed, addr = %x\n", __func__, addr);
else else
dev_dbg(&priv->client->dev, dev_dbg(&priv->client->dev,
"%s : addr 0x%x, val=0x%x\n", __func__, "%s : addr 0x%x, val=0x%x\n", __func__,
addr, *val); addr, uint_val);
*val = uint_val;
return err; return err;
} }