Li Huafei (1): media: atomisp: Add check for rgby_data memory allocation failure
Mauro Carvalho Chehab (1): media: atomisp: remove #ifdef HAS_NO_HMEM
.../atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c | 2 -- .../raw_aa_binning_1.0/ia_css_raa.host.c | 2 -- .../pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c | 5 ----- .../media/atomisp/pci/runtime/binary/src/binary.c | 4 ---- drivers/staging/media/atomisp/pci/sh_css_params.c | 12 ++---------- 5 files changed, 2 insertions(+), 23 deletions(-)
From: Mauro Carvalho Chehab mchehab+huawei@kernel.org
stable inclusion from stable-v5.10.231 commit 4478f599a2835a5bd643b7e20d09c43b60ceba93 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBF35N CVE: CVE-2024-56705
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 63705da3dfc8922a2dbfc3c805a5faadb4416954 ]
This is not defined anywhere, so, solve the ifdefs, getting rid of them.
Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Stable-dep-of: ed61c5913950 ("media: atomisp: Add check for rgby_data memory allocation failure") Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Wang Wensheng wangwensheng4@huawei.com --- .../atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c | 2 -- .../raw_aa_binning_1.0/ia_css_raa.host.c | 2 -- .../pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c | 5 ----- .../media/atomisp/pci/runtime/binary/src/binary.c | 4 ---- drivers/staging/media/atomisp/pci/sh_css_params.c | 10 ---------- 5 files changed, 23 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c b/drivers/staging/media/atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c index 82aa69b74677..2091f001502d 100644 --- a/drivers/staging/media/atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c +++ b/drivers/staging/media/atomisp/pci/isp/kernels/bh/bh_2/ia_css_bh.host.c @@ -13,7 +13,6 @@ * more details. */
-#if !defined(HAS_NO_HMEM)
#include "ia_css_types.h" #include "sh_css_internal.h" @@ -63,4 +62,3 @@ ia_css_bh_encode( uDIGIT_FITTING(from->ae_y_coef_b, 16, SH_CSS_AE_YCOEF_SHIFT); }
-#endif diff --git a/drivers/staging/media/atomisp/pci/isp/kernels/raw_aa_binning/raw_aa_binning_1.0/ia_css_raa.host.c b/drivers/staging/media/atomisp/pci/isp/kernels/raw_aa_binning/raw_aa_binning_1.0/ia_css_raa.host.c index 29c707ecf9f3..9b756daddee0 100644 --- a/drivers/staging/media/atomisp/pci/isp/kernels/raw_aa_binning/raw_aa_binning_1.0/ia_css_raa.host.c +++ b/drivers/staging/media/atomisp/pci/isp/kernels/raw_aa_binning/raw_aa_binning_1.0/ia_css_raa.host.c @@ -13,7 +13,6 @@ * more details. */
-#if !defined(HAS_NO_HMEM)
#include "ia_css_types.h" #include "sh_css_internal.h" @@ -32,4 +31,3 @@ ia_css_raa_encode( (void)from; }
-#endif diff --git a/drivers/staging/media/atomisp/pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c b/drivers/staging/media/atomisp/pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c index ba52c80df4a5..bd7b89d9475b 100644 --- a/drivers/staging/media/atomisp/pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c +++ b/drivers/staging/media/atomisp/pci/isp/kernels/s3a/s3a_1.0/ia_css_s3a.host.c @@ -227,10 +227,6 @@ ia_css_s3a_hmem_decode( struct ia_css_3a_statistics *host_stats, const struct ia_css_bh_table *hmem_buf) { -#if defined(HAS_NO_HMEM) - (void)host_stats; - (void)hmem_buf; -#else struct ia_css_3a_rgby_output *out_ptr; int i;
@@ -291,7 +287,6 @@ ia_css_s3a_hmem_decode( out_ptr[0].g -= diff; out_ptr[0].b -= diff; out_ptr[0].y -= diff; -#endif }
void diff --git a/drivers/staging/media/atomisp/pci/runtime/binary/src/binary.c b/drivers/staging/media/atomisp/pci/runtime/binary/src/binary.c index 060d38749570..002bd8cf2863 100644 --- a/drivers/staging/media/atomisp/pci/runtime/binary/src/binary.c +++ b/drivers/staging/media/atomisp/pci/runtime/binary/src/binary.c @@ -805,11 +805,7 @@ ia_css_binary_3a_grid_info(const struct ia_css_binary *binary, s3a_info->deci_factor_log2 = binary->deci_factor_log2; s3a_info->elem_bit_depth = SH_CSS_BAYER_BITS; s3a_info->use_dmem = binary->info->sp.s3a.s3atbl_use_dmem; -#if defined(HAS_NO_HMEM) - s3a_info->has_histogram = 1; -#else s3a_info->has_histogram = 0; -#endif IA_CSS_LEAVE_ERR_PRIVATE(err); return err; } diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c index 8d6514c45eeb..90aa8fc999ef 100644 --- a/drivers/staging/media/atomisp/pci/sh_css_params.c +++ b/drivers/staging/media/atomisp/pci/sh_css_params.c @@ -16,12 +16,10 @@ #include "gdc_device.h" /* gdc_lut_store(), ... */ #include "isp.h" /* ISP_VEC_ELEMBITS */ #include "vamem.h" -#if !defined(HAS_NO_HMEM) #ifndef __INLINE_HMEM__ #define __INLINE_HMEM__ #endif #include "hmem.h" -#endif /* !defined(HAS_NO_HMEM) */ #define IA_CSS_INCLUDE_PARAMETERS #define IA_CSS_INCLUDE_ACC_PARAMETERS
@@ -1513,10 +1511,8 @@ ia_css_translate_3a_statistics( ia_css_s3a_vmem_decode(host_stats, isp_stats->vmem_stats_hi, isp_stats->vmem_stats_lo); } -#if !defined(HAS_NO_HMEM) IA_CSS_LOG("3A: HMEM"); ia_css_s3a_hmem_decode(host_stats, isp_stats->hmem_stats); -#endif
IA_CSS_LEAVE("void"); } @@ -2255,9 +2251,7 @@ ia_css_isp_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) me->vmem_size = ISP_S3ATBL_HI_LO_STRIDE_BYTES * grid->aligned_height; } -#if !defined(HAS_NO_HMEM) me->hmem_size = sizeof_hmem(HMEM0_ID); -#endif
/* All subsections need to be aligned to the system bus width */ me->dmem_size = CEIL_MUL(me->dmem_size, HIVE_ISP_DDR_WORD_BYTES); @@ -4360,12 +4354,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) me->data = kvmalloc(grid_size * sizeof(*me->data), GFP_KERNEL); if (!me->data) goto err; -#if !defined(HAS_NO_HMEM) /* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */ me->rgby_data = kvmalloc(sizeof_hmem(HMEM0_ID), GFP_KERNEL); -#else - me->rgby_data = NULL; -#endif
IA_CSS_LEAVE("return=%p", me); return me;
From: Li Huafei lihuafei1@huawei.com
stable inclusion from stable-v5.10.231 commit ed61c59139509f76d3592683c90dc3fdc6e23cd6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBF35N CVE: CVE-2024-56705
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit ed61c59139509f76d3592683c90dc3fdc6e23cd6 ]
In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode(). Adding a check to fix this potential issue.
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Li Huafei lihuafei1@huawei.com Reviewed-by: Andy Shevchenko andy@kernel.org Link: https://lore.kernel.org/r/20241104145051.3088231-1-lihuafei1@huawei.com Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Wang Wensheng wangwensheng4@huawei.com --- drivers/staging/media/atomisp/pci/sh_css_params.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c index 90aa8fc999ef..34d8ffb7742d 100644 --- a/drivers/staging/media/atomisp/pci/sh_css_params.c +++ b/drivers/staging/media/atomisp/pci/sh_css_params.c @@ -4356,6 +4356,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid) goto err; /* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */ me->rgby_data = kvmalloc(sizeof_hmem(HMEM0_ID), GFP_KERNEL); + if (!me->rgby_data) + goto err;
IA_CSS_LEAVE("return=%p", me); return me;
反馈: 您发送到kernel@openeuler.org的补丁/补丁集,已成功转换为PR! PR链接地址: https://gitee.com/openeuler/kernel/pulls/14713 邮件列表地址:https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/V...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/14713 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/V...