diff options
| author | Jammy Huang <jammy_huang@aspeedtech.com> | 2023-07-19 06:33:18 +0000 |
|---|---|---|
| committer | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2023-07-19 12:57:51 +0200 |
| commit | c281355068bc258fd619c5aefd978595bede7bfe (patch) | |
| tree | ffdcdefffee4dd2e4cd352a20d258e0fc06edae5 | |
| parent | f2183847cf65c8df3ffcf0e7ee7d11425c93794e (diff) | |
| download | linux-stable-c281355068bc258fd619c5aefd978595bede7bfe.tar.gz linux-stable-c281355068bc258fd619c5aefd978595bede7bfe.tar.bz2 linux-stable-c281355068bc258fd619c5aefd978595bede7bfe.zip | |
media: aspeed: Fix memory overwrite if timing is 1600x900
When capturing 1600x900, system could crash when system memory usage is
tight.
The way to reproduce this issue:
1. Use 1600x900 to display on host
2. Mount ISO through 'Virtual media' on OpenBMC's web
3. Run script as below on host to do sha continuously
#!/bin/bash
while [ [1] ];
do
find /media -type f -printf '"%h/%f"\n' | xargs sha256sum
done
4. Open KVM on OpenBMC's web
The size of macro block captured is 8x8. Therefore, we should make sure
the height of src-buf is 8 aligned to fix this issue.
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
| -rw-r--r-- | drivers/media/platform/aspeed/aspeed-video.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/platform/aspeed/aspeed-video.c b/drivers/media/platform/aspeed/aspeed-video.c index c0a8b90b6733..a9c2c69b2ed9 100644 --- a/drivers/media/platform/aspeed/aspeed-video.c +++ b/drivers/media/platform/aspeed/aspeed-video.c @@ -1129,7 +1129,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) static void aspeed_video_set_resolution(struct aspeed_video *video) { struct v4l2_bt_timings *act = &video->active_timings; - unsigned int size = act->width * act->height; + unsigned int size = act->width * ALIGN(act->height, 8); /* Set capture/compression frame sizes */ aspeed_video_calc_compressed_size(video, size); @@ -1146,7 +1146,7 @@ static void aspeed_video_set_resolution(struct aspeed_video *video) u32 width = ALIGN(act->width, 64); aspeed_video_write(video, VE_CAP_WINDOW, width << 16 | act->height); - size = width * act->height; + size = width * ALIGN(act->height, 8); } else { aspeed_video_write(video, VE_CAP_WINDOW, act->width << 16 | act->height); |