From: Moudy Ho <moudy.ho@mediatek.com>
To: Mauro Carvalho Chehab <mchehab@kernel.org>,
Matthias Brugger <matthias.bgg@gmail.com>,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Ping-Hsun Wu <ping-hsun.wu@mediatek.com>
Cc: <linux-kernel@vger.kernel.org>, <linux-media@vger.kernel.org>,
<linux-arm-kernel@lists.infradead.org>,
<linux-mediatek@lists.infradead.org>,
<Project_Global_Chrome_Upstream_Group@mediatek.com>,
Moudy Ho <moudy.ho@mediatek.com>
Subject: [PATCH v6 01/12] media: platform: mtk-mdp3: fix potential frame size overflow in mdp_try_fmt_mplane()
Date: Wed, 8 Feb 2023 17:08:44 +0800 [thread overview]
Message-ID: <20230208090855.18934-2-moudy.ho@mediatek.com> (raw)
In-Reply-To: <20230208090855.18934-1-moudy.ho@mediatek.com>
Fix overflow risk when setting certain formats whose frame size exceeds
a RGB24 with 7723x7723 resolution.
For example, a 7723x7724 RGB24 frame:
1. bpl (byte per line) = 7723 * 3.
2. Overflow occurs when bpl * 7724 * depth.
Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
---
drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c
index 4e84a37ecdfc..36336d169bd9 100644
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-regs.c
@@ -4,6 +4,7 @@
* Author: Ping-Hsun Wu <ping-hsun.wu@mediatek.com>
*/
+#include <linux/math64.h>
#include <media/v4l2-common.h>
#include <media/videobuf2-v4l2.h>
#include <media/videobuf2-dma-contig.h>
@@ -428,14 +429,15 @@ const struct mdp_format *mdp_try_fmt_mplane(struct v4l2_format *f,
u32 bpl = pix_mp->plane_fmt[i].bytesperline;
u32 min_si, max_si;
u32 si = pix_mp->plane_fmt[i].sizeimage;
+ u64 di;
bpl = clamp(bpl, min_bpl, max_bpl);
pix_mp->plane_fmt[i].bytesperline = bpl;
- min_si = (bpl * pix_mp->height * fmt->depth[i]) /
- fmt->row_depth[i];
- max_si = (bpl * s.max_height * fmt->depth[i]) /
- fmt->row_depth[i];
+ di = (u64)bpl * pix_mp->height * fmt->depth[i];
+ min_si = (u32)div_u64(di, fmt->row_depth[i]);
+ di = (u64)bpl * s.max_height * fmt->depth[i];
+ max_si = (u32)div_u64(di, fmt->row_depth[i]);
si = clamp(si, min_si, max_si);
pix_mp->plane_fmt[i].sizeimage = si;
--
2.18.0
next prev parent reply other threads:[~2023-02-08 9:09 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-08 9:08 [PATCH v6 00/12] Add support for multiple chips Moudy Ho
2023-02-08 9:08 ` Moudy Ho [this message]
2023-02-08 9:08 ` [PATCH v6 02/12] media: platform: mtk-mdp3: add files for chip configuration Moudy Ho
2023-02-08 9:08 ` [PATCH v6 03/12] media: platform: mtk-mdp3: chip config split about component settings Moudy Ho
2023-02-08 9:08 ` [PATCH v6 04/12] media: platform: mtk-mdp3: chip config split about subcomponents Moudy Ho
2023-02-08 9:08 ` [PATCH v6 05/12] media: platform: mtk-mdp3: chip config split about color format Moudy Ho
2023-02-08 9:08 ` [PATCH v6 06/12] media: platform: mtk-mdp3: chip config split about resolution limitations Moudy Ho
2023-02-08 9:08 ` [PATCH v6 07/12] media: platform: mtk-mdp3: chip config split about pipe info Moudy Ho
2023-02-08 9:08 ` [PATCH v6 08/12] media: platform: mtk-mdp3: extend mdp_color format for compressed mode Moudy Ho
2023-02-08 9:08 ` [PATCH v6 09/12] media: platform: mtk-mdp3: dynamically allocate component clocks Moudy Ho
2023-02-08 9:08 ` [PATCH v6 10/12] media: platform: mtk-mdp3: Split general definitions used in MDP3 Moudy Ho
2023-02-08 9:08 ` [PATCH v6 11/12] media: platform: mtk-mdp3: decompose hardware-related information in shared memory Moudy Ho
2023-02-08 9:08 ` [PATCH v6 12/12] media: platform: mtk-mdp3: reconfigure " Moudy Ho
2023-03-21 13:29 ` [PATCH v6 00/12] Add support for multiple chips Hans Verkuil
2023-03-23 6:16 ` Moudy Ho (何宗原)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230208090855.18934-2-moudy.ho@mediatek.com \
--to=moudy.ho@mediatek.com \
--cc=Project_Global_Chrome_Upstream_Group@mediatek.com \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=matthias.bgg@gmail.com \
--cc=mchehab@kernel.org \
--cc=ping-hsun.wu@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).