Re: [PATCH v3 6/6] media: amlogic-c3: Add validations for ae and awb config

[Laurent Pinchart]

On Mon, May 04, 2026 at 09:19:30AM +0200, Jacopo Mondi wrote:
> On Mon, May 04, 2026 at 06:54:09AM +0000, Ricardo Ribalda wrote:
> > Avoid invalid memory access if the zones_num is bigger than
> > zone_weight.
> >
> > This patch fixes the following smatch errors:
> > drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> > drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
> > drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> > drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
> >
> > Cc: stable@xxxxxxxxxxxxxxx
> > Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
> > Signed-off-by: Ricardo Ribalda <ribalda@xxxxxxxxxxxx>
> > ---
> >  drivers/media/platform/amlogic/c3/isp/c3-isp-params.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> > index 6f9ca7a7dd88..aec3eed0e443 100644
> > --- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> > +++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
> > @@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
> >  	c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
> >
> >  	zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> > +	if (zones_num > C3_ISP_AWB_MAX_ZONES)
> > +		zones_num = C3_ISP_AWB_MAX_ZONES;
> 
> Or
>         zones_num = min(cfg->horiz_zones_num * cfg->vert_zones_num,
>                         C3_ISP_AWB_MAX_ZONES);

I have a slight preference for that, but both options work for me.

Reviewed-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>

> Whatever you prefer:
> Reviewed-by: Jacopo Mondi <jacopo.mondi@xxxxxxxxxxxxxxxx>
> 
> >
> >  	/* Need to write 8 weights at once */
> >  	for (i = 0; i < zones_num / 8; i++) {
> > @@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
> >  	c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
> >
> >  	zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
> > +	if (zones_num > C3_ISP_AE_MAX_ZONES)
> > +		zones_num = C3_ISP_AE_MAX_ZONES;
> >
> >  	/* Need to write 8 weights at once */
> >  	for (i = 0; i < zones_num / 8; i++) {

-- 
Regards,

Laurent Pinchart