media: intel-ipu3: cio2: fix a crash with out-of-bounds access

Browse source

When dmabuf is used for BLOB type frame, the frame
buffers allocated by gralloc will hold more pages
than the valid frame data due to height alignment.

In this case, the page numbers in sg list could exceed the
FBPT upper limit value - max_lops(8)*1024 to cause crash.

Limit the LOP access to the valid data length
to avoid FBPT sub-entries overflow.

Signed-off-by: Yong Zhi <yong.zhi@intel.com>
Signed-off-by: Cao Bing Bu <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

...

This commit is contained in:

Yong Zhi 2018-01-03 21:57:16 -05:00 • committed by Mauro Carvalho Chehab

parent 883dd4c1b8

commit c7cbef1fdb

1 changed files with 5 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/media/pci/intel/ipu3/ipu3-cio2.c

View file