From: Benoit Parrot <bparrot@ti.com> To: Hans Verkuil <hverkuil@xs4all.nl> Cc: <linux-media@vger.kernel.org>, <devicetree@vger.kernel.org>, <linux-kernel@vger.kernel.org>, Benoit Parrot <bparrot@ti.com> Subject: [Patch v3 08/21] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic Date: Mon, 7 Oct 2019 10:09:56 -0500 [thread overview] Message-ID: <20191007151009.22095-9-bparrot@ti.com> (raw) In-Reply-To: <20191007151009.22095-1-bparrot@ti.com> v4l2-compliance fails with this message: warn: v4l2-test-formats.cpp(717): \ TRY_FMT cannot handle an invalid pixelformat. test VIDIOC_TRY_FMT: FAIL This causes the following kernel panic: Unable to handle kernel paging request at virtual address 56595561 pgd = ecd80e00 *pgd=00000000 Internal error: Oops: 205 [#1] PREEMPT SMP ARM ... CPU: 0 PID: 930 Comm: v4l2-compliance Not tainted \ 4.14.62-01715-gc8cd67f49a19 #1 Hardware name: Generic DRA72X (Flattened Device Tree) task: ece44d80 task.stack: ecc6e000 PC is at __vpe_try_fmt+0x18c/0x2a8 [ti_vpe] LR is at 0x8 Because the driver fails to properly check the 'num_planes' values for proper ranges it ends up accessing out of bound data causing the kernel panic. Since this driver only handle single or dual plane pixel format, make sure the provided value does not exceed 2 planes. Signed-off-by: Benoit Parrot <bparrot@ti.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com> --- drivers/media/platform/ti-vpe/vpe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c index bbbf11174e16..1278d457f753 100644 --- a/drivers/media/platform/ti-vpe/vpe.c +++ b/drivers/media/platform/ti-vpe/vpe.c @@ -1650,7 +1650,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, &pix->height, MIN_H, MAX_H, H_ALIGN, S_ALIGN); - if (!pix->num_planes) + if (!pix->num_planes || pix->num_planes > 2) pix->num_planes = fmt->coplanar ? 2 : 1; else if (pix->num_planes > 1 && !fmt->coplanar) pix->num_planes = 1; -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Benoit Parrot <bparrot@ti.com> To: Hans Verkuil <hverkuil@xs4all.nl> Cc: linux-media@vger.kernel.org, devicetree@vger.kernel.org, linux-kernel@vger.kernel.org, Benoit Parrot <bparrot@ti.com> Subject: [Patch v3 08/21] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic Date: Mon, 7 Oct 2019 10:09:56 -0500 [thread overview] Message-ID: <20191007151009.22095-9-bparrot@ti.com> (raw) In-Reply-To: <20191007151009.22095-1-bparrot@ti.com> v4l2-compliance fails with this message: warn: v4l2-test-formats.cpp(717): \ TRY_FMT cannot handle an invalid pixelformat. test VIDIOC_TRY_FMT: FAIL This causes the following kernel panic: Unable to handle kernel paging request at virtual address 56595561 pgd = ecd80e00 *pgd=00000000 Internal error: Oops: 205 [#1] PREEMPT SMP ARM ... CPU: 0 PID: 930 Comm: v4l2-compliance Not tainted \ 4.14.62-01715-gc8cd67f49a19 #1 Hardware name: Generic DRA72X (Flattened Device Tree) task: ece44d80 task.stack: ecc6e000 PC is at __vpe_try_fmt+0x18c/0x2a8 [ti_vpe] LR is at 0x8 Because the driver fails to properly check the 'num_planes' values for proper ranges it ends up accessing out of bound data causing the kernel panic. Since this driver only handle single or dual plane pixel format, make sure the provided value does not exceed 2 planes. Signed-off-by: Benoit Parrot <bparrot@ti.com> Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com> --- drivers/media/platform/ti-vpe/vpe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c index bbbf11174e16..1278d457f753 100644 --- a/drivers/media/platform/ti-vpe/vpe.c +++ b/drivers/media/platform/ti-vpe/vpe.c @@ -1650,7 +1650,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, &pix->height, MIN_H, MAX_H, H_ALIGN, S_ALIGN); - if (!pix->num_planes) + if (!pix->num_planes || pix->num_planes > 2) pix->num_planes = fmt->coplanar ? 2 : 1; else if (pix->num_planes > 1 && !fmt->coplanar) pix->num_planes = 1; -- 2.17.1
next prev parent reply other threads:[~2019-10-07 15:07 UTC|newest] Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-10-07 15:09 [Patch v3 00/21] media: vpe: maintenance Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 01/21] media: ti-vpe: Fix a parallel build issue Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 02/21] media: ti-vpe: vpe: Fix Motion Vector vpdma stride Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 03/21] media: ti-vpe: vpe: Add missing null pointer checks Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 04/21] media: ti-vpe: vpe: Remove unnecessary use of container_of Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 05/21] media: ti-vpe: Add support for SEQ_BT Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 06/21] media: ti-vpe: Add support for NV21 format Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 07/21] media: ti-vpe: Set MAX height supported to 2048 pixels Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot [this message] 2019-10-07 15:09 ` [Patch v3 08/21] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic Benoit Parrot 2019-10-07 15:09 ` [Patch v3 09/21] media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 10/21] media: ti-vpe: vpe: Make sure YUYV is set as default format Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:09 ` [Patch v3 11/21] media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage Benoit Parrot 2019-10-07 15:09 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 12/21] media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 13/21] media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 14/21] media: ti-vpe: vpdma: Use fixed type for address in descriptor Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 15/21] media: ti-vpe: Set the DMA mask and coherent mask Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 16/21] media: ti-vpe: vpe: use standard struct instead of duplicating fields Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 17/21] media: ti-vpe: vpe: fix v4l2_compliance issue related to xfer_func Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 18/21] media: ti-vpe: csc: rgb-to-yuv HD full range coeff are wrong Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 19/21] media: v4l2-common: add pixel encoding support Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 20/21] media: v4l2-common: add RGB565 and RGB55 to v4l2_format_info Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot 2019-10-07 15:10 ` [Patch v3 21/21] media: ti-vpe: vpe: don't rely on colorspace member for conversion Benoit Parrot 2019-10-07 15:10 ` Benoit Parrot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20191007151009.22095-9-bparrot@ti.com \ --to=bparrot@ti.com \ --cc=devicetree@vger.kernel.org \ --cc=hverkuil@xs4all.nl \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-media@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.