Messages in this thread Patch in this message |  | | From | Hungyu Lin <> | | Subject | [PATCH] media: tegra-video: vi: validate format index before bitmap_set | | Date | Sun, 12 Apr 2026 15:48:43 +0000 |
| |
tegra_get_format_idx_by_code() returns -1 when no matching format is found. vi_tpg_fmts_bitmap_init() used the returned index directly in bitmap_set(), which may lead to an out-of-bounds access when the format is not present.
This can occur when TPG is enabled on SoCs whose video_formats[] table does not include the requested media bus formats.
Validate the index before calling bitmap_set().
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com> --- drivers/staging/media/tegra-video/vi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c index 9c0b38585d63..dd8911640d98 100644 --- a/drivers/staging/media/tegra-video/vi.c +++ b/drivers/staging/media/tegra-video/vi.c @@ -1020,12 +1020,14 @@ static void vi_tpg_fmts_bitmap_init(struct tegra_vi_channel *chan) index = tegra_get_format_idx_by_code(chan->vi, MEDIA_BUS_FMT_SRGGB10_1X10, 0); - bitmap_set(chan->tpg_fmts_bitmap, index, 1); + if (index >= 0) + bitmap_set(chan->tpg_fmts_bitmap, index, 1); index = tegra_get_format_idx_by_code(chan->vi, MEDIA_BUS_FMT_RGB888_1X32_PADHI, 0); - bitmap_set(chan->tpg_fmts_bitmap, index, 1); + if (index >= 0) + bitmap_set(chan->tpg_fmts_bitmap, index, 1); } static int vi_fmts_bitmap_init(struct tegra_vi_channel *chan) -- 2.34.1
|  |