android_kernel_motorola_sm6375/drivers/media
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Benoit Parrot 32fa026d24 media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic
[ Upstream commit a37980ac5be29b83da67bf7d571c6bd9f90f8e45 ]

v4l2-compliance fails with this message:

   warn: v4l2-test-formats.cpp(717): \
   	TRY_FMT cannot handle an invalid pixelformat.
   test VIDIOC_TRY_FMT: FAIL

This causes the following kernel panic:

Unable to handle kernel paging request at virtual address 56595561
pgd = ecd80e00
*pgd=00000000
Internal error: Oops: 205 [#1] PREEMPT SMP ARM
...
CPU: 0 PID: 930 Comm: v4l2-compliance Not tainted \
	4.14.62-01715-gc8cd67f49a19 #1
Hardware name: Generic DRA72X (Flattened Device Tree)
task: ece44d80 task.stack: ecc6e000
PC is at __vpe_try_fmt+0x18c/0x2a8 [ti_vpe]
LR is at 0x8

Because the driver fails to properly check the 'num_planes' values for
proper ranges it ends up accessing out of bound data causing the kernel
panic.

Since this driver only handle single or dual plane pixel format, make
sure the provided value does not exceed 2 planes.

Signed-off-by: Benoit Parrot <bparrot@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-31 16:44:01 +01:00
..
cec media: cec-notifier: clear cec_adap in cec_notifier_unregister 2019-08-26 06:30:32 -03:00
common media: v4l2-tpg: add support for new pixelformats 2019-07-30 12:16:45 -04:00
dvb-core media: dvb-core: fix a memory leak bug 2019-08-21 18:39:54 -03:00
dvb-frontends media: don't do a 31 bit shift on a signed int 2019-08-26 14:11:10 -03:00
firewire media: firewire: Make structure fdtv_ca constant 2019-08-21 18:39:55 -03:00
i2c media: ov6650: Fix stored crop rectangle not in sync with hardware 2019-12-31 16:43:24 +01:00
mc
mmc
pci media: cx88: Fix some error handling path in 'cx8800_initdev()' 2019-12-31 16:43:55 +01:00
platform media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic 2019-12-31 16:44:01 +01:00
radio media: radio: wl1273: fix interrupt masking on release 2019-12-17 19:56:19 +01:00
rc media: rc: mark input device as pointing stick 2019-12-13 08:42:45 +01:00
spi media: Clarify how menus are hidden by SUBDRV_AUTOSELECT 2019-08-19 12:00:29 -03:00
tuners media: Clarify how menus are hidden by SUBDRV_AUTOSELECT 2019-08-19 12:00:29 -03:00
usb media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() 2019-12-31 16:43:41 +01:00
v4l2-core media/v4l2-core: untag user pointers in videobuf_dma_contig_user_get 2019-09-25 17:51:41 -07:00
Kconfig media: Clarify how menus are hidden by SUBDRV_AUTOSELECT 2019-08-19 12:00:29 -03:00
Makefile