From patchwork Thu Aug 10 12:23:34 2017
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Dan Carpenter <dan.carpenter@oracle.com>
X-Patchwork-Id: 43106
Received: from vger.kernel.org ([209.132.180.67])
	by www.linuxtv.org with esmtp (Exim 4.84_2)
	(envelope-from <linux-media-owner@vger.kernel.org>)
	id 1dfmXo-00031S-Js; Thu, 10 Aug 2017 12:26:32 +0000
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752339AbdHJM02 (ORCPT <rfc822;mkrufky@linuxtv.org> + 1 other);
	Thu, 10 Aug 2017 08:26:28 -0400
Received: from userp1040.oracle.com ([156.151.31.81]:34426 "EHLO
	userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752557AbdHJM0W (ORCPT
	<rfc822;linux-media@vger.kernel.org>);
	Thu, 10 Aug 2017 08:26:22 -0400
Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234])
	by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2)
	with ESMTP id v7ACQ544023939
	(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256
	verify=OK); Thu, 10 Aug 2017 12:26:06 GMT
Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235])
	by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id
	v7ACQ5kw007606
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256
	verify=OK); Thu, 10 Aug 2017 12:26:05 GMT
Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10])
	by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id
	v7ACQ49g013679; Thu, 10 Aug 2017 12:26:04 GMT
Received: from mwanda (/197.157.0.19)
	by default (Oracle Beehive Gateway v4.0)
	with ESMTP ; Thu, 10 Aug 2017 05:25:58 -0700
Date: Thu, 10 Aug 2017 15:23:34 +0300
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Alan Cox <alan@linux.intel.com>, Varsha Rao <rvarsha016@gmail.com>,
	Hans Verkuil <hans.verkuil@cisco.com>,
	Arvind Yadav <arvind.yadav.cs@gmail.com>,
	Hans de Goede <hdegoede@redhat.com>,
	sayli karnik <karniksayli1995@gmail.com>,
	Arnd Bergmann <arnd@arndb.de>, linux-media@vger.kernel.org,
	devel@driverdev.osuosl.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] [media] staging: atomisp: fix bounds checking in
	mt9m114_s_exposure_selection()
Message-ID: <20170810122334.tqruyh6xelk7fg6i@mwanda>
MIME-Version: 1.0
Content-Disposition: inline
X-Mailer: git-send-email haha only kidding
User-Agent: NeoMutt/20170609 (1.8.3)
X-Source-IP: aserv0022.oracle.com [141.146.126.234]
Sender: linux-media-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-media.vger.kernel.org>
X-Mailing-List: linux-media@vger.kernel.org

These clamp_t() calls are no-ops because we don't save the results.  It
leads to an array out of bounds bug.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/staging/media/atomisp/i2c/mt9m114.c b/drivers/staging/media/atomisp/i2c/mt9m114.c
index 448e072ca037..7816bc428641 100644
--- a/drivers/staging/media/atomisp/i2c/mt9m114.c
+++ b/drivers/staging/media/atomisp/i2c/mt9m114.c
@@ -1209,10 +1209,10 @@ static int mt9m114_s_exposure_selection(struct v4l2_subdev *sd,
 		return -EINVAL;
 	}
 
-	clamp_t(int, win_left, 0, 4);
-	clamp_t(int, win_top, 0, 4);
-	clamp_t(int, win_right, 0, 4);
-	clamp_t(int, win_bottom, 0, 4);
+	win_left   = clamp_t(int, win_left, 0, 4);
+	win_top    = clamp_t(int, win_top, 0, 4);
+	win_right  = clamp_t(int, win_right, 0, 4);
+	win_bottom = clamp_t(int, win_bottom, 0, 4);
 
 	ret = mt9m114_write_reg_array(client, mt9m114_exp_average, NO_POLLING);
 	if (ret) {