media: intel/ipu6: add csi2 port sanity check in notifier bound

Invalid csi2 port will break the isys notifier bound ops as it is
trying to access an invalid csi2 sub-device instance based on the
port. It will trigger a mc warning, and it will cause the sensor
driver to unbound an inexistent isys csi2 and crash. Adding a
csi2 port sanity check, return error to avoid such case.

Fixes: f50c4ca0a820 ("media: intel/ipu6: add the main input system driver")
Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
[Sakari Ailus: Fix spelling of "nports" field.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys.c b/drivers/media/pci/intel/ipu6/ipu6-isys.c
index 1998b72ac07de960372e73d2e55b61dd8397c8ba..8b9b77719bb16421c6aefca757ab090bd9f50edf 100644 (file)
--- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
@@ -678,6 +678,12 @@ static int isys_notifier_bound(struct v4l2_async_notifier *notifier,
                container_of(asc, struct sensor_async_sd, asc);
        int ret;
 
+       if (s_asd->csi2.port >= isys->pdata->ipdata->csi2.nports) {
+               dev_err(&isys->adev->auxdev.dev, "invalid csi2 port %u\n",
+                       s_asd->csi2.port);
+               return -EINVAL;
+       }
+
        ret = ipu_bridge_instantiate_vcm(sd->dev);
        if (ret) {
                dev_err(&isys->adev->auxdev.dev, "instantiate vcm failed\n");