shinys000114/kernel_common_drivers
1
0
Fork 0
mirror of https://github.com/hardkernel/kernel_common_drivers.git synced 2026-06-25 12:03:48 +09:00
Code Issues Packages Projects Releases Wiki Activity

UVM: v4l data copy need size check [1/1]

Browse Source 
PD#SWPL-175011

Problem:
screencap v4lvideo lead to kernel panic

Solution:
add size check before v4lvideo data copy

Verify:
t3 U

Change-Id: I137cdf83ad8a888188446be63bd789a0d92fdd4a
Signed-off-by: Yongjie Zhu <yongjie.zhu@amlogic.com>
This commit is contained in:
Yongjie Zhu
2024-07-10 03:31:53 +00:00
committed by gerrit autosubmit
parent c0abab7dc1
commit c5dfd532ca
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/media/video_processor/v4lvideo/v4lvideo.c
+14 -2
View File
@@ -1218,13 +1218,20 @@ void v4lvideo_data_copy(struct v4l_data_t *v4l_data,
return;
}
pr_debug("%s: vf->type: %d vf->compWidth: %d\n",
__func__, vf->type, vf->compWidth);
pr_debug("%s: vf->type:%d vf->compWidth:%d vf->compHeight:%d\n",
__func__, vf->type, vf->compWidth, vf->compHeight);
pr_debug("vf->width:%d vf->height:%d v4l_data->width:%d v4l_data->height:%d\n",
vf->width, vf->height, v4l_data->width, v4l_data->height);
/*
* fbc decoder for VIDTYPE_COMPRESS
*/
if ((vf->type & VIDTYPE_COMPRESS)) {
if (vf->compWidth > v4l_data->width || vf->compHeight > v4l_data->height) {
pr_err("%s: afbc video WxH larger than buffer WxH.\n", __func__);
return;
}
if (print_flag)
pr_info("fbc decoder path\n");
if ((vf->bitdepth & BITDEPTH_YMASK) == BITDEPTH_Y10)
@@ -1282,6 +1289,11 @@ void v4lvideo_data_copy(struct v4l_data_t *v4l_data,
/*
* GE2D copy for non-compress
*/
if (vf->width > v4l_data->width || vf->height > v4l_data->height) {
pr_err("%s: none-afbc video WxH larger than buffer WxH.\n", __func__);
return;
}
is_10bit = vf->bitdepth & BITDEPTH_Y10;
di_mode = vf->type & VIDTYPE_DI_PW;
if (is_10bit && !di_mode) {