From 078b5e459522ad23f479223d4a5dfd6bebbd9846 Mon Sep 17 00:00:00 2001 From: Yandong Lin Date: Tue, 4 Apr 2023 09:23:35 +0800 Subject: [PATCH] video: rockchip: mpp: prevent page order out of bounds Signed-off-by: Yandong Lin Change-Id: I4c79ee639d0fbc910fbb12525ea0a3c8e7841d1d --- drivers/video/rockchip/mpp/mpp_rkvdec2.c | 3 ++- drivers/video/rockchip/mpp/mpp_rkvenc2.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/video/rockchip/mpp/mpp_rkvdec2.c b/drivers/video/rockchip/mpp/mpp_rkvdec2.c index 8bce83b9b16a..8f0fdc7b86c9 100644 --- a/drivers/video/rockchip/mpp/mpp_rkvdec2.c +++ b/drivers/video/rockchip/mpp/mpp_rkvdec2.c @@ -1688,8 +1688,9 @@ static int rkvdec2_free_rcbbuf(struct platform_device *pdev, struct rkvdec2_dev if (dec->rcb_page) { size_t page_size = PAGE_ALIGN(dec->rcb_size - dec->sram_size); + int order = min(get_order(page_size), MAX_ORDER); - __free_pages(dec->rcb_page, get_order(page_size)); + __free_pages(dec->rcb_page, order); } if (dec->rcb_iova) { domain = dec->mpp.iommu_info->domain; diff --git a/drivers/video/rockchip/mpp/mpp_rkvenc2.c b/drivers/video/rockchip/mpp/mpp_rkvenc2.c index b3edf3c33525..c28d7204c317 100644 --- a/drivers/video/rockchip/mpp/mpp_rkvenc2.c +++ b/drivers/video/rockchip/mpp/mpp_rkvenc2.c @@ -2508,8 +2508,9 @@ static int rkvenc2_free_rcbbuf(struct platform_device *pdev, struct rkvenc_dev * if (enc->rcb_page) { size_t page_size = PAGE_ALIGN(enc->sram_used - enc->sram_size); + int order = min(get_order(page_size), MAX_ORDER); - __free_pages(enc->rcb_page, get_order(page_size)); + __free_pages(enc->rcb_page, order); } if (enc->sram_iova) { domain = enc->mpp.iommu_info->domain;