renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-23 04:34:11 +08:00
Code

media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init

Browse Source 
With "pages" initialized to vb length + 1 pages, the condition
check if(!pages--) will break at one more page than intended,
this can result in out-of-bound access to b->lop[i][j] when setting
the last dummy page.

Fixes: c7cbef1fdb ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access")

Signed-off-by: Yong Zhi <yong.zhi@intel.com>
Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Yong Zhi 2018-01-19 01:27:34 -05:00 committed by Mauro Carvalho Chehab
parent 5eb8c768f4
commit 401f69308f
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/media/pci/intel/ipu3/ipu3-cio2.c
View File

@ -839,9 +839,8 @@ static int cio2_vb2_buf_init(struct vb2_buffer *vb)
container_of(vb, struct cio2_buffer, vbb.vb2_buf);
static const unsigned int entries_per_page =
CIO2_PAGE_SIZE / sizeof(u32);
unsigned int pages = DIV_ROUND_UP(vb->planes[0].length,
CIO2_PAGE_SIZE) + 1;
unsigned int lops = DIV_ROUND_UP(pages, entries_per_page);
unsigned int pages = DIV_ROUND_UP(vb->planes[0].length, CIO2_PAGE_SIZE);
unsigned int lops = DIV_ROUND_UP(pages + 1, entries_per_page);
struct sg_table *sg;
struct sg_page_iter sg_iter;
int i, j;