media: amlogic-c3: Add validations for ae and awb config

Avoid invalid memory access if the zones_num is bigger than
zone_weight.

This patch fixes the following smatch errors:
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:111 c3_isp_params_awb_wt() error: buffer overflow 'cfg->zone_weight' 768 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max
drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:227 c3_isp_params_ae_wt() error: buffer overflow 'cfg->zone_weight' 255 <= u32max

Cc: stable@vger.kernel.org
Fixes: fb2e135208f3 ("media: platform: Add C3 ISP driver")
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Keke Li <keke.li@amlogic.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
index 6f9ca7a7dd882328edab2f94c8bdac100119717e..aec3eed0e443e9bac8d9b59cb9a5e1455a06a1a7 100644 (file)
--- a/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
+++ b/drivers/media/platform/amlogic/c3/isp/c3-isp-params.c
@@ -104,6 +104,8 @@ static void c3_isp_params_awb_wt(struct c3_isp_device *isp,
        c3_isp_write(isp, ISP_AWB_BLK_WT_ADDR, 0);
 
        zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
+       if (zones_num > C3_ISP_AWB_MAX_ZONES)
+               zones_num = C3_ISP_AWB_MAX_ZONES;
 
        /* Need to write 8 weights at once */
        for (i = 0; i < zones_num / 8; i++) {
@@ -220,6 +222,8 @@ static void c3_isp_params_ae_wt(struct c3_isp_device *isp,
        c3_isp_write(isp, ISP_AE_BLK_WT_ADDR, 0);
 
        zones_num = cfg->horiz_zones_num * cfg->vert_zones_num;
+       if (zones_num > C3_ISP_AE_MAX_ZONES)
+               zones_num = C3_ISP_AE_MAX_ZONES;
 
        /* Need to write 8 weights at once */
        for (i = 0; i < zones_num / 8; i++) {