* [PATCH] media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init
@ 2018-01-19 6:27 Yong Zhi
2018-01-19 14:07 ` Sakari Ailus
0 siblings, 1 reply; 2+ messages in thread
From: Yong Zhi @ 2018-01-19 6:27 UTC (permalink / raw)
To: linux-media, sakari.ailus; +Cc: rajmohan.mani, tfiga, Yong Zhi, Cao Bing Bu
With "pages" initialized to vb length + 1 pages, the condition
check if(!pages--) will break at one more page than intended,
this can result in out-of-bound access to b->lop[i][j] when setting
the last dummy page.
Fix: commit c7cbef1fdb54 ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access")
Signed-off-by: Yong Zhi <yong.zhi@intel.com>
Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com>
---
drivers/media/pci/intel/ipu3/ipu3-cio2.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 9db752a7f363..8c9f8f56f5df 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -839,9 +839,8 @@ static int cio2_vb2_buf_init(struct vb2_buffer *vb)
container_of(vb, struct cio2_buffer, vbb.vb2_buf);
static const unsigned int entries_per_page =
CIO2_PAGE_SIZE / sizeof(u32);
- unsigned int pages = DIV_ROUND_UP(vb->planes[0].length,
- CIO2_PAGE_SIZE) + 1;
- unsigned int lops = DIV_ROUND_UP(pages, entries_per_page);
+ unsigned int pages = DIV_ROUND_UP(vb->planes[0].length, CIO2_PAGE_SIZE);
+ unsigned int lops = DIV_ROUND_UP(pages + 1, entries_per_page);
struct sg_table *sg;
struct sg_page_iter sg_iter;
int i, j;
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init
2018-01-19 6:27 [PATCH] media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init Yong Zhi
@ 2018-01-19 14:07 ` Sakari Ailus
0 siblings, 0 replies; 2+ messages in thread
From: Sakari Ailus @ 2018-01-19 14:07 UTC (permalink / raw)
To: Yong Zhi; +Cc: linux-media, rajmohan.mani, tfiga, Cao Bing Bu
Hi Yong,
Thanks for the patch.
On Fri, Jan 19, 2018 at 12:27:34AM -0600, Yong Zhi wrote:
> With "pages" initialized to vb length + 1 pages, the condition
> check if(!pages--) will break at one more page than intended,
> this can result in out-of-bound access to b->lop[i][j] when setting
> the last dummy page.
>
> Fix: commit c7cbef1fdb54 ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access")
Fixes: c7cbef1fdb54 ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access")
I've applied the patch with that change.
> Signed-off-by: Yong Zhi <yong.zhi@intel.com>
> Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com>
> ---
> drivers/media/pci/intel/ipu3/ipu3-cio2.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
> index 9db752a7f363..8c9f8f56f5df 100644
> --- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
> +++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
> @@ -839,9 +839,8 @@ static int cio2_vb2_buf_init(struct vb2_buffer *vb)
> container_of(vb, struct cio2_buffer, vbb.vb2_buf);
> static const unsigned int entries_per_page =
> CIO2_PAGE_SIZE / sizeof(u32);
> - unsigned int pages = DIV_ROUND_UP(vb->planes[0].length,
> - CIO2_PAGE_SIZE) + 1;
> - unsigned int lops = DIV_ROUND_UP(pages, entries_per_page);
> + unsigned int pages = DIV_ROUND_UP(vb->planes[0].length, CIO2_PAGE_SIZE);
> + unsigned int lops = DIV_ROUND_UP(pages + 1, entries_per_page);
> struct sg_table *sg;
> struct sg_page_iter sg_iter;
> int i, j;
--
Regards,
Sakari Ailus
sakari.ailus@linux.intel.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-01-19 14:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-19 6:27 [PATCH] media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init Yong Zhi
2018-01-19 14:07 ` Sakari Ailus
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.