diff mbox series

media: atomisp: Fix a pointer math problem in dump_sp_dmem()

Message ID 20200616092728.GB11940@mwanda (mailing list archive)
State Superseded, archived
Headers
Series media: atomisp: Fix a pointer math problem in dump_sp_dmem() |

Commit Message

Dan Carpenter June 16, 2020, 9:27 a.m. UTC 
  The "io_virt_addr" variable is a u32 pointer and it should be
incremented by one instead of four.  The current code will dump bogus
data and read beyond the end of the buffer.

Fixes: 69a03e36c711 ("media: atomisp: get rid of an iomem abstraction layer")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/staging/media/atomisp/pci/atomisp_cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Sakari Ailus June 16, 2020, 9:51 a.m. UTC | #1 
On Tue, Jun 16, 2020 at 12:27:28PM +0300, Dan Carpenter wrote:
> The "io_virt_addr" variable is a u32 pointer and it should be
> incremented by one instead of four.  The current code will dump bogus
> data and read beyond the end of the buffer.
> 
> Fixes: 69a03e36c711 ("media: atomisp: get rid of an iomem abstraction layer")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
diff mbox series

Patch

diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 7b936e5a5f03..6faf223c6d20 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -682,7 +682,7 @@  void dump_sp_dmem(struct atomisp_device *isp, unsigned int addr,
 	do {
 		data = *io_virt_addr;
 		dev_dbg(isp->dev, "%s, \t [0x%x]:0x%x\n", __func__, addr, data);
-		io_virt_addr += sizeof(u32);
+		io_virt_addr++;
 		size32 -= 1;
 	} while (size32 > 0);
 }