raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com

Browse Source 
[ Upstream commit e3b86f4e55 ]

On the case tmp_dcim=1, the index of buffer is miscalculated.
This generate a NULL pointer dereference later.

So let's fix the calcul and add a check to prevent this to reappear.

Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Corentin Labbe
2021-12-14 17:16:32 +01:00
committed by Greg Kroah-Hartman
parent bd01629315
commit bafec1a6ba
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/staging/media/zoran/zoran_device.c
View File

@@ -879,7 +879,7 @@ static void zoran_reap_stat_com(struct zoran *zr)
if (zr->jpg_settings.tmp_dcm == 1) if (zr->jpg_settings.tmp_dcm == 1)
i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM; i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM;
else else
i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1; i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2;
stat_com = le32_to_cpu(zr->stat_com[i]); stat_com = le32_to_cpu(zr->stat_com[i]);
if ((stat_com & 1) == 0) { if ((stat_com & 1) == 0) {
@@ -891,6 +891,11 @@ static void zoran_reap_stat_com(struct zoran *zr)
size = (stat_com & GENMASK(22, 1)) >> 1; size = (stat_com & GENMASK(22, 1)) >> 1;
buf = zr->inuse[i]; buf = zr->inuse[i];
if (!buf) {
spin_unlock_irqrestore(&zr->queued_bufs_lock, flags);
pci_err(zr->pci_dev, "No buffer at slot %d\n", i);
return;
}
buf->vbuf.vb2_buf.timestamp = ktime_get_ns(); buf->vbuf.vb2_buf.timestamp = ktime_get_ns();
if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) { if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) {