summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorYong Zhi <yong.zhi@intel.com>2018-01-19 01:27:34 -0500
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2018-01-23 08:08:44 -0500
commit401f69308fe344b4353fad5233d99c7efa9deef5 (patch)
treedd957532b69bf1863097e14c945e1a03e1273060 /drivers/media
parent5eb8c768f49361dfd72ac55c82051695b7ed5ee3 (diff)
media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init
With "pages" initialized to vb length + 1 pages, the condition check if(!pages--) will break at one more page than intended, this can result in out-of-bound access to b->lop[i][j] when setting the last dummy page. Fixes: c7cbef1fdb54 ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access") Signed-off-by: Yong Zhi <yong.zhi@intel.com> Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/pci/intel/ipu3/ipu3-cio2.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/media/pci/intel/ipu3/ipu3-cio2.c b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
index 724cd8d9d573..6c4444b31f4b 100644
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2.c
+++ b/drivers/media/pci/intel/ipu3/ipu3-cio2.c
@@ -839,9 +839,8 @@ static int cio2_vb2_buf_init(struct vb2_buffer *vb)
container_of(vb, struct cio2_buffer, vbb.vb2_buf);
static const unsigned int entries_per_page =
CIO2_PAGE_SIZE / sizeof(u32);
- unsigned int pages = DIV_ROUND_UP(vb->planes[0].length,
- CIO2_PAGE_SIZE) + 1;
- unsigned int lops = DIV_ROUND_UP(pages, entries_per_page);
+ unsigned int pages = DIV_ROUND_UP(vb->planes[0].length, CIO2_PAGE_SIZE);
+ unsigned int lops = DIV_ROUND_UP(pages + 1, entries_per_page);
struct sg_table *sg;
struct sg_page_iter sg_iter;
int i, j;