From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063951; b=B7YVOoU7Nj+K9I32pXxBSfQnPgSqQF/vk5HOC+LECsraXofdRXtiFJmixFOAXqDHcYgd E+DqtyjI9f0yR3QqIGO+n9zWRbKbP7SAq9K95d6dM5sFVwbc0Yv3laxXM7Q+mhoiizoLr t5s1D55nVjxAtGRUBorpsB1phqUUq91ll6eSRE9MreABpLsTXUwTA0wrEVkH8frPPHNyF U7CGBuczW5vPd1wbsC/2RbsScqBFqUS0UCpGbD8Pp9bVySGFMgVMCoWHtL2QTpQXMEKF3 sN2r1xF7hOMSP6LTy2WvpW947VXNe4MbdoeCHERqAP5QJ/q1V3Za6BhcD35BBKypuKQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063951; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=qCSrklTKTgiStaZfaXrplwXzTegu6lMg7R50p/D1mhA=; b=TChPOAUfee4nNNiuVdooJDwDNBsh/phozObVjyrh7STS9CP1gDbnA7OrXVswmhRO4Vu2 fomU8XXTRBqAVt55jVNqzcriBG8U06EGlrQEp1RQEu0+8g5nekx3XefrYcfipxplRV9tp CJPKS7E8mAfg6W31ZUgCMZYRJz5ZU3BkJFHvi3a1PYDflqTuisqFhG0FEgCTbKdzX3wfc HYmSIFBSQ0o78kc8wy4YFAuPEeVqKmv+RqB5wOWVhgJskYapnclcMn+S4WFO3560WZZl2 +f4RV8xBpmfnuLGQRH78XhoNhDkc+BWYZYRHCo31njam3eBMApgG8adc8SaBFhlCiFA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=a3OxtMwH; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E139606D829; Sat, 7 Nov 2026 15:05:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=a3OxtMwH Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF1881F008A2; Sat, 7 Nov 2026 15:05:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063951; bh=qCSrklTKTgiStaZfaXrplwXzTegu6lMg7R50p/D1mhA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=a3OxtMwHTOiCx6TisLYpIPGq1fYo9VEahjwoz1uQQqRA8U4f6Cq+67LvXuoGNlSbA 6xxvwobwNQrk08MdfOfjO/4+qVnBnWHAEnyyLvE5IA3HLWQZaAMYbF7xotspqNSCz1 JFa83RZk8rD0CocHI+1x7irs5ZJIoYKT7F52swHk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com, Maxim Skokov , Hans Verkuil , Sasha Levin Subject: [PATCH 7.3 0142/1257] media: vivid: round the height down to the vertical subsampling factor Date: Sat, 7 Nov 2026 08:40:38 -0500 Message-ID: <20261107134943.232387512@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maxim Skokov [ Upstream commit a2ec28dd2a88d0721fc4a30242861e2be01d4023 ] syzbot reports a vmalloc out-of-bounds write in the test pattern generator: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2617 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x2063/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 720 at addr ffffc900038f9d50 by task vivid-000-vid-c/6017 The reproducer requests a 720x49 NV12 capture format, i.e. an odd height for a format whose chroma plane is vertically subsampled. The buffer size is derived from the height by a truncating division: sizes[p] = (tpg_g_line_width(&dev->tpg, p) * h) / dev->fmt_cap->vdownsampling[p] + dev->fmt_cap->data_offset[p]; For a single buffer holding both planes tpg_g_line_width() returns 720 + 720 / 2 = 1080, so 1080 * 49 = 52920 bytes get allocated. tpg_fill_plane_buffer() however emits one chroma line for every two luma lines, i.e. DIV_ROUND_UP(49, 2) = 25 lines, and thus needs 49 * 720 + 25 * 720 = 53280 bytes. The memcpy() of the last chroma line runs 360 bytes past the end of the buffer. An odd height is not meaningful for a 4:2:0 format in the first place, since the chroma plane would have to hold half a line. Rather than fixing up each of the ~10 sites that divide the height by vdownsampling[], round the height down to a multiple of the vertical subsampling factor where it enters the driver. Adjusting the format is what TRY_FMT/S_FMT are for, and it keeps every later division exact. Formats without vertical subsampling are unaffected and keep accepting odd heights. Tested with the syzbot reproducer, which no longer triggers the splat, and by streaming NV12, NV21, YUV420, YVU420 and YUYV at heights 47, 48, 49, 51, 480, 481 and 1081. v4l2-compliance gives identical results before and after (48 of 50 succeeded on the vivid device in both cases; the two failures are pre-existing and unrelated). Fixes: ddcaee9dd4c0 ("[media] vivid: add support for single buffer planar formats") Cc: stable@kernel.org Reported-by: syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cb43e758a4dc84dd467f Signed-off-by: Maxim Skokov Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index e204490847095..147af0f9b0777 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -570,6 +570,7 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv, const struct vivid_fmt *fmt; unsigned bytesperline, max_bpl; unsigned factor = 1; + unsigned int vdiv = 1; unsigned w, h; unsigned p; bool user_set_csc = !!(mp->flags & V4L2_PIX_FMT_FLAG_SET_CSC); @@ -622,6 +623,18 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv, mp->height = r.height / factor; } + /* + * The chroma planes of vertically subsampled formats hold + * height / vdownsampling lines. If the height is not a multiple of + * the subsampling factor, then the buffer size calculations round + * that number down while the test pattern generator rounds it up, + * so the generator writes one line past the end of the buffer. + * Round the height down to keep both in sync. + */ + for (p = 0; p < fmt->planes; p++) + vdiv = max(vdiv, fmt->vdownsampling[p]); + mp->height = rounddown(mp->height, vdiv); + /* This driver supports custom bytesperline values */ mp->num_planes = fmt->buffers; -- 2.53.0