lkml.org 
[lkml]   [2019]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 068/219] media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic
    Date
    From: Benoit Parrot <bparrot@ti.com>

    [ Upstream commit a37980ac5be29b83da67bf7d571c6bd9f90f8e45 ]

    v4l2-compliance fails with this message:

    warn: v4l2-test-formats.cpp(717): \
    TRY_FMT cannot handle an invalid pixelformat.
    test VIDIOC_TRY_FMT: FAIL

    This causes the following kernel panic:

    Unable to handle kernel paging request at virtual address 56595561
    pgd = ecd80e00
    *pgd=00000000
    Internal error: Oops: 205 [#1] PREEMPT SMP ARM
    ...
    CPU: 0 PID: 930 Comm: v4l2-compliance Not tainted \
    4.14.62-01715-gc8cd67f49a19 #1
    Hardware name: Generic DRA72X (Flattened Device Tree)
    task: ece44d80 task.stack: ecc6e000
    PC is at __vpe_try_fmt+0x18c/0x2a8 [ti_vpe]
    LR is at 0x8

    Because the driver fails to properly check the 'num_planes' values for
    proper ranges it ends up accessing out of bound data causing the kernel
    panic.

    Since this driver only handle single or dual plane pixel format, make
    sure the provided value does not exceed 2 planes.

    Signed-off-by: Benoit Parrot <bparrot@ti.com>
    Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/platform/ti-vpe/vpe.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
    index ca9095b80309..54f0d9d3cc49 100644
    --- a/drivers/media/platform/ti-vpe/vpe.c
    +++ b/drivers/media/platform/ti-vpe/vpe.c
    @@ -1646,7 +1646,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
    &pix->height, MIN_H, MAX_H, H_ALIGN,
    S_ALIGN);

    - if (!pix->num_planes)
    + if (!pix->num_planes || pix->num_planes > 2)
    pix->num_planes = fmt->coplanar ? 2 : 1;
    else if (pix->num_planes > 1 && !fmt->coplanar)
    pix->num_planes = 1;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-12-29 18:42    [W:4.029 / U:0.560 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site