[PATCH v1 04/11] media: intel/ipu6: clamp crop top offset in ipu6_isys_csi2_set_sel()

[Valerii Sokolov]

In ipu6_isys_csi2_set_sel(), sel->r.height is clamped with:

    clamp(sel->r.height & ~1, IPU6_ISYS_MIN_HEIGHT,
          sink_ffmt->height - sel->r.top);

However, user space supplies sel->r.top (__s32) without bounds checking,
while sink_ffmt->height is __u32. If sel->r.top is negative or greater
than sink_ffmt->height - IPU6_ISYS_MIN_HEIGHT, the unsigned upper bound
sink_ffmt->height - sel->r.top either becomes 0 (smaller than the lower
bound IPU6_ISYS_MIN_HEIGHT, violating clamp()'s lo <= hi invariant) or
wraps around in u32 to a value larger than sink_ffmt->height (allowing
sel->r.height to exceed sink_ffmt->height and storing an out-of-bounds
crop->top offset).

Clamp sel->r.top to [0, sink_ffmt->height - IPU6_ISYS_MIN_HEIGHT] before
aligning it and calculating the allowed crop height range.

Fixes: a11a5570a09d ("media: intel/ipu6: add IPU6 CSI2 receiver v4l2 sub-device")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Valerii Sokolov <valerii.sokolov@xxxxx>
---
 drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c b/drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c
index 1525454279..a2491729d3 100644
--- a/drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys-csi2.c
@@ -821,6 +821,8 @@ static int ipu6_isys_csi2_set_sel(struct v4l2_subdev *sd,
 	/* Only vertical cropping is supported */
 	sel->r.left = 0;
 	sel->r.width = sink_ffmt->width;
+	sel->r.top = clamp_t(s32, sel->r.top, 0,
+			     sink_ffmt->height - IPU6_ISYS_MIN_HEIGHT);
 	/* Non-bayer formats can't be single line cropped */
 	if (!ipu6_isys_is_bayer_format(sink_ffmt->code))
 		sel->r.top &= ~1;
-- 
2.56.0