From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6145C282E7 for ; Thu, 11 Aug 2022 15:57:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237049AbiHKP5a (ORCPT ); Thu, 11 Aug 2022 11:57:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45606 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237321AbiHKP4R (ORCPT ); Thu, 11 Aug 2022 11:56:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72F1EA0308; Thu, 11 Aug 2022 08:47:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F00C9B82169; Thu, 11 Aug 2022 15:47:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C662C433D6; Thu, 11 Aug 2022 15:46:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1660232821; bh=AEsPbHbEe182m0t/WV82gX2x94xwC8rhYlBhPE0RDVU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M1OiGsdCpXlRHaDFZBqyXG/sIjmVd8tgtXksnOnqApCn4DsJdCnfKPyjpq2XrM5Am yixrQ8PO/zNGV01sYmGGzDc5hJxNEQlvIiFLK6DiQ3xbkVZuCt0XzfmjNbGPTdgKis DAArdvJy/qZKucZSAGk52Q14yG/gvzHNiaeBe8fORxfwmGDch0H+AU8C5LBZp6bObr kIZEJ7q+XcLFeA/DGpcuzPh0SlCA/qpAWjhP1BJeFU+4GLQKlx/JG8rHogKpNtlgXt AKiKJcx+hu+fbw60peZS8hiA9gG561nEzgFc4NkBKSWYvehZr6mdDmjMamGclicYzw aTzZOKnqfLhhQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Justin Green , Andres Calderon Jaramillo , Nicolas Dufresne , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin , tiffany.lin@mediatek.com, andrew-ct.chen@mediatek.com, matthias.bgg@gmail.com, linux-media@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Subject: [PATCH AUTOSEL 5.18 42/93] media: mediatek: vcodec: return EINVAL if plane is too small Date: Thu, 11 Aug 2022 11:41:36 -0400 Message-Id: <20220811154237.1531313-42-sashal@kernel.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220811154237.1531313-1-sashal@kernel.org> References: <20220811154237.1531313-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Justin Green [ Upstream commit f5caaa47f55fa742f1a230e5b4258c139e223c74 ] Modify vb2ops_vdec_buf_prepare to return EINVAL if the size of the plane is less than the size of the image. Currently we just log an error and return 0 anyway, which may cause a buffer overrun bug. Signed-off-by: Justin Green Suggested-by: Andres Calderon Jaramillo Reviewed-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c index c8ee5e2b4f69..e52cf8109989 100644 --- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c +++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c @@ -725,6 +725,7 @@ int vb2ops_vdec_buf_prepare(struct vb2_buffer *vb) mtk_v4l2_err("data will not fit into plane %d (%lu < %d)", i, vb2_plane_size(vb, i), q_data->sizeimage[i]); + return -EINVAL; } } -- 2.35.1