staging: vc04_services: fix pointer arithmetic in create_pagelist

[nolasoft]

Summary

Fix a pointer-arithmetic bug in the vmalloc handling path of create_pagelist().

Problem

In drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c:

struct page *pg =
    vmalloc_to_page(((unsigned int *)bulk->offset +
                     (actual_pages * PAGE_SIZE)));

Adding an integer to an unsigned int * multiplies the offset by sizeof(unsigned int) (4). Consequently the address becomes:bulk->offset + (actual_pages * PAGE_SIZE * 4)instead of the intended:bulk->offset + (actual_pages * PAGE_SIZE)Only the first page is correct; later pages are wrong. This can lead to
incorrect DMA mappings, data corruption, or NULL page pointers.

[pelwell]

This looks like a valid fix to me. You should add:

Fixes: 0d2df8b10b54 ("staging: vchiq_core: Subsume 'offset' in struct vchiq_bulk")

FYI @uajain, who may want to upstream this himself.

[6by9]

Build failure due to missing ; from the end of the line.

[popcornmix]

Looks like this affects the legacy camera stack (bcm2835-camera) and legacy audio (bcm2835-audio, but only when force_bulk=1 or firmware peer_version<2).
Most other cases use zero copy, so don't hit this code.
Neither are these are common paths, but they can be enabled and if they are it will be fatal. So nice find.

[6by9]

Looks like this affects the legacy camera stack (bcm2835-camera)

I did have a report not so long back that bcm2835-camera wasn't working on 6.18. I confirmed that, but wasn't seeing crashes, and hadn't dug into the reason. This would be a plausible explanation.

[pelwell]

Replacing (unsigned int *) with (void *) should be sufficient.

[nolasoft]

now it should be ok, unfortunatly i edited it from github edit tool.

[pelwell]

Thanks - I'll squash the commits and patch up the commit message when I merge it.

[popcornmix]

Drop the spurious blank line when you merge.