media: intel-ipu3: cio2: fixup off-by-one bug in cio2_vb2_buf_init

Browse source

With "pages" initialized to vb length + 1 pages, the condition
check if(!pages--) will break at one more page than intended,
this can result in out-of-bound access to b->lop[i][j] when setting
the last dummy page.

Fixes: c7cbef1fdb ("media: intel-ipu3: cio2: fix a crash with out-of-bounds access")

Signed-off-by: Yong Zhi <yong.zhi@intel.com>
Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

...

This commit is contained in:

Yong Zhi 2018-01-19 01:27:34 -05:00 • committed by Mauro Carvalho Chehab

parent 5eb8c768f4

commit 401f69308f

1 changed files with 2 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/media/pci/intel/ipu3/ipu3-cio2.c

View file