* [PATCH] media: nxp: imx8-isi: Fix potential out-of-bounds issues
@ 2026-01-22 7:18 Guoniu Zhou
2026-01-22 14:57 ` Frank Li
0 siblings, 1 reply; 2+ messages in thread
From: Guoniu Zhou @ 2026-01-22 7:18 UTC (permalink / raw)
To: Laurent Pinchart, Mauro Carvalho Chehab, Shawn Guo, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Stefan Riedmueller,
Jacopo Mondi, Christian Hemp, Frank Li
Cc: Dong Aisheng, linux-media, imx, linux-arm-kernel, linux-kernel,
Guoniu Zhou, stable
From: Guoniu Zhou <guoniu.zhou@nxp.com>
The maximum downscaling factor supported by ISI can be up to 16. Add
minimum value constraint before applying the setting to hardware.
Otherwise, the process will not respond even when Ctrl+C is executed.
Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guoniu Zhou <guoniu.zhou@nxp.com>
---
drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h | 11 +++++++++++
drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 6 +++---
drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 6 ++----
3 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
index 3cbd35305af0f8026c4f76b5eb5d0864f8e36dc3..cf87f1da6b83d398e4433c4c62395e2fdb7c8d3a 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
@@ -59,6 +59,17 @@ struct v4l2_m2m_dev;
#define MXC_ISI_M2M "mxc-isi-m2m"
#define MXC_MAX_PLANES 3
+/*
+ * ISI scaling engine works in two parts: it performs pre-decimation of
+ * the image followed by bilinear filtering to achieve the desired
+ * downscaling factor.
+ * The decimation filter provides a maximum downscaling factor of 8, and
+ * the subsequent bilinear filter provides a maximum downscaling factor
+ * of 2. Combined, the maximum scaling factor can be up to 16.
+ */
+#define CLAMP_DOWNSCALE_16(val, max_val) \
+ clamp((val), max(1U, (max_val) >> 4), (max_val))
+
struct mxc_isi_dev;
struct mxc_isi_m2m_ctx;
diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
index f425ac7868547da401e86ce5a9b70a9890e72541..8860d89713667d06abc94e6024526fabac46feb7 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
@@ -509,9 +509,9 @@ __mxc_isi_m2m_try_fmt_vid(struct mxc_isi_m2m_ctx *ctx,
const enum mxc_isi_video_type type)
{
if (type == MXC_ISI_VIDEO_M2M_CAP) {
- /* Downscaling only */
- pix->width = min(pix->width, ctx->queues.out.format.width);
- pix->height = min(pix->height, ctx->queues.out.format.height);
+ /* Downscaling one-sixteenth only */
+ pix->width = CLAMP_DOWNSCALE_16(pix->width, ctx->queues.out.format.width);
+ pix->height = CLAMP_DOWNSCALE_16(pix->height, ctx->queues.out.format.height);
}
return mxc_isi_format_try(ctx->m2m->pipe, pix, type);
diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
index a41c51dd9ce0f2eeb779e9aa2461593b0d635f41..c3ffc8a38d1269c0a4e6493b4d75690f01cc87bb 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
@@ -647,10 +647,8 @@ static int mxc_isi_pipe_set_selection(struct v4l2_subdev *sd,
sel->r.left = 0;
sel->r.top = 0;
- sel->r.width = clamp(sel->r.width, MXC_ISI_MIN_WIDTH,
- format->width);
- sel->r.height = clamp(sel->r.height, MXC_ISI_MIN_HEIGHT,
- format->height);
+ sel->r.width = CLAMP_DOWNSCALE_16(sel->r.width, format->width);
+ sel->r.height = CLAMP_DOWNSCALE_16(sel->r.height, format->height);
rect = mxc_isi_pipe_get_pad_compose(pipe, state,
MXC_ISI_PIPE_PAD_SINK);
---
base-commit: eb4ee870747c3a77a9c3c84d84efb64bd481013a
change-id: 20260122-isi-74f87fbb9a6f
Best regards,
--
Guoniu Zhou <guoniu.zhou@nxp.com>
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] media: nxp: imx8-isi: Fix potential out-of-bounds issues
2026-01-22 7:18 [PATCH] media: nxp: imx8-isi: Fix potential out-of-bounds issues Guoniu Zhou
@ 2026-01-22 14:57 ` Frank Li
0 siblings, 0 replies; 2+ messages in thread
From: Frank Li @ 2026-01-22 14:57 UTC (permalink / raw)
To: Guoniu Zhou
Cc: Laurent Pinchart, Mauro Carvalho Chehab, Shawn Guo, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Stefan Riedmueller,
Jacopo Mondi, Christian Hemp, Dong Aisheng, linux-media, imx,
linux-arm-kernel, linux-kernel, Guoniu Zhou, stable
On Thu, Jan 22, 2026 at 03:18:18PM +0800, Guoniu Zhou wrote:
> From: Guoniu Zhou <guoniu.zhou@nxp.com>
>
Subject: media: nxp: imx8-isi: Add maximum downscaling check to fix out-of-bounds issue
> The maximum downscaling factor supported by ISI can be up to 16. Add
> minimum value constraint before applying the setting to hardware.
> Otherwise, the process will not respond even when Ctrl+C is executed.
>
> Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guoniu Zhou <guoniu.zhou@nxp.com>
> ---
> drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h | 11 +++++++++++
> drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c | 6 +++---
> drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c | 6 ++----
> 3 files changed, 16 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
> index 3cbd35305af0f8026c4f76b5eb5d0864f8e36dc3..cf87f1da6b83d398e4433c4c62395e2fdb7c8d3a 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
> @@ -59,6 +59,17 @@ struct v4l2_m2m_dev;
> #define MXC_ISI_M2M "mxc-isi-m2m"
> #define MXC_MAX_PLANES 3
>
> +/*
> + * ISI scaling engine works in two parts: it performs pre-decimation of
> + * the image followed by bilinear filtering to achieve the desired
> + * downscaling factor.
Nit: need space line between two paragraph.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> + * The decimation filter provides a maximum downscaling factor of 8, and
> + * the subsequent bilinear filter provides a maximum downscaling factor
> + * of 2. Combined, the maximum scaling factor can be up to 16.
> + */
> +#define CLAMP_DOWNSCALE_16(val, max_val) \
> + clamp((val), max(1U, (max_val) >> 4), (max_val))
> +
> struct mxc_isi_dev;
> struct mxc_isi_m2m_ctx;
>
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
> index f425ac7868547da401e86ce5a9b70a9890e72541..8860d89713667d06abc94e6024526fabac46feb7 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
> @@ -509,9 +509,9 @@ __mxc_isi_m2m_try_fmt_vid(struct mxc_isi_m2m_ctx *ctx,
> const enum mxc_isi_video_type type)
> {
> if (type == MXC_ISI_VIDEO_M2M_CAP) {
> - /* Downscaling only */
> - pix->width = min(pix->width, ctx->queues.out.format.width);
> - pix->height = min(pix->height, ctx->queues.out.format.height);
> + /* Downscaling one-sixteenth only */
> + pix->width = CLAMP_DOWNSCALE_16(pix->width, ctx->queues.out.format.width);
> + pix->height = CLAMP_DOWNSCALE_16(pix->height, ctx->queues.out.format.height);
> }
>
> return mxc_isi_format_try(ctx->m2m->pipe, pix, type);
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
> index a41c51dd9ce0f2eeb779e9aa2461593b0d635f41..c3ffc8a38d1269c0a4e6493b4d75690f01cc87bb 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
> @@ -647,10 +647,8 @@ static int mxc_isi_pipe_set_selection(struct v4l2_subdev *sd,
>
> sel->r.left = 0;
> sel->r.top = 0;
> - sel->r.width = clamp(sel->r.width, MXC_ISI_MIN_WIDTH,
> - format->width);
> - sel->r.height = clamp(sel->r.height, MXC_ISI_MIN_HEIGHT,
> - format->height);
> + sel->r.width = CLAMP_DOWNSCALE_16(sel->r.width, format->width);
> + sel->r.height = CLAMP_DOWNSCALE_16(sel->r.height, format->height);
>
> rect = mxc_isi_pipe_get_pad_compose(pipe, state,
> MXC_ISI_PIPE_PAD_SINK);
>
> ---
> base-commit: eb4ee870747c3a77a9c3c84d84efb64bd481013a
> change-id: 20260122-isi-74f87fbb9a6f
>
> Best regards,
> --
> Guoniu Zhou <guoniu.zhou@nxp.com>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-01-22 14:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-22 7:18 [PATCH] media: nxp: imx8-isi: Fix potential out-of-bounds issues Guoniu Zhou
2026-01-22 14:57 ` Frank Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox