From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061974; b=oBTF1pnUMpr831mo86MSSmkbZIbyRMSNx7eb4btek7VrJXCYHpUgVa3ySDB2uGFn6tJI ECh9dv8tX1H40vwILVk8Si4WXzvGgB5DLBaVq/bxzgO8dpYk3XI8hPsU+VC+5ggxfaghx C5HMky+nE2nMuuHNMKnxFWZ7y2wtLGamCI1yU6pb0q2fDHSWz688FRk5i/0feMhIIfD87 kXPGxHPW2bgJxPu9F8sPw8VJMoemhF8LUaaAJdPqRDg1iJnZ49GMqDf4CwTl6zUclbKBF 2AnVh/on9kee9WA0z64UaoqMCaJ9p8mFYr0yUi4y8Ye4FsMCO6RvcxpOi2bsEBW0e1g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061974; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=UxkNlhTDNQgcoS2PzOztS4u6I3m5TpvD/BEhDTCq1aw=; b=vk6G89USmD9VJu1imPYr+V7ccZAnAgHj79qGE3udEeGXxSCF3wfhadua22X6a7wdLsbS PYvXgHEyU3apWgmJQHbaCGKpX7bbqAm4xjBZJcEN6XKF8bxJmEbPpyYOGPUa9WzpM6SzV 5ifyzee9GHfO/kcqvXoWUtagzBhqtWx520/3b26wU5nLYHSM6vfQYvdC7cd4AOQSZWgFO HZb3eKPfWlx0J8yfqlhz4SMvmqq0mgD0BWqYttttxls1ev1wlJPaOc8sFMktYDCciXL+G exwCECVOinrq8HxjA5HJIj56UVbaytK8fj2Um6jltiE87LW3So/P+SwiNxz7pZ4Z9fA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=vagAEG0i; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E807606A32E; Sat, 7 Nov 2026 14:32:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=vagAEG0i Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B0A31F008A1; Sat, 7 Nov 2026 14:32:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061974; bh=UxkNlhTDNQgcoS2PzOztS4u6I3m5TpvD/BEhDTCq1aw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=vagAEG0iUOjb4oHOauiGPSaLjOXWvwobKw9EYZgVYhfmiHzRwp+GOunyCSpaUfAD4 qrouV6FSwZzpX7ETuNY3tGz2gD4+g1TRqme0Gr/IHVGYKeOS/nM1jvBYcQU/BFn4DY yNiYB3fED/JxgEYNf82UUamDObyt2/NA5W5vV69Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com, Maxim Skokov , Hans Verkuil , Sasha Levin Subject: [PATCH 6.12 0969/1536] media: vivid: round the height down to the vertical subsampling factor Date: Sat, 7 Nov 2026 08:49:45 -0500 Message-ID: <20261107135024.862935542@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maxim Skokov [ Upstream commit a2ec28dd2a88d0721fc4a30242861e2be01d4023 ] syzbot reports a vmalloc out-of-bounds write in the test pattern generator: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2617 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x2063/0x4160 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 720 at addr ffffc900038f9d50 by task vivid-000-vid-c/6017 The reproducer requests a 720x49 NV12 capture format, i.e. an odd height for a format whose chroma plane is vertically subsampled. The buffer size is derived from the height by a truncating division: sizes[p] = (tpg_g_line_width(&dev->tpg, p) * h) / dev->fmt_cap->vdownsampling[p] + dev->fmt_cap->data_offset[p]; For a single buffer holding both planes tpg_g_line_width() returns 720 + 720 / 2 = 1080, so 1080 * 49 = 52920 bytes get allocated. tpg_fill_plane_buffer() however emits one chroma line for every two luma lines, i.e. DIV_ROUND_UP(49, 2) = 25 lines, and thus needs 49 * 720 + 25 * 720 = 53280 bytes. The memcpy() of the last chroma line runs 360 bytes past the end of the buffer. An odd height is not meaningful for a 4:2:0 format in the first place, since the chroma plane would have to hold half a line. Rather than fixing up each of the ~10 sites that divide the height by vdownsampling[], round the height down to a multiple of the vertical subsampling factor where it enters the driver. Adjusting the format is what TRY_FMT/S_FMT are for, and it keeps every later division exact. Formats without vertical subsampling are unaffected and keep accepting odd heights. Tested with the syzbot reproducer, which no longer triggers the splat, and by streaming NV12, NV21, YUV420, YVU420 and YUYV at heights 47, 48, 49, 51, 480, 481 and 1081. v4l2-compliance gives identical results before and after (48 of 50 succeeded on the vivid device in both cases; the two failures are pre-existing and unrelated). Fixes: ddcaee9dd4c0 ("[media] vivid: add support for single buffer planar formats") Cc: stable@kernel.org Reported-by: syzbot+cb43e758a4dc84dd467f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cb43e758a4dc84dd467f Signed-off-by: Maxim Skokov Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/test-drivers/vivid/vivid-vid-cap.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index 327a7f8cd00d9..8bac68ce11f76 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -567,6 +567,7 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv, const struct vivid_fmt *fmt; unsigned bytesperline, max_bpl; unsigned factor = 1; + unsigned int vdiv = 1; unsigned w, h; unsigned p; bool user_set_csc = !!(mp->flags & V4L2_PIX_FMT_FLAG_SET_CSC); @@ -619,6 +620,18 @@ int vivid_try_fmt_vid_cap(struct file *file, void *priv, mp->height = r.height / factor; } + /* + * The chroma planes of vertically subsampled formats hold + * height / vdownsampling lines. If the height is not a multiple of + * the subsampling factor, then the buffer size calculations round + * that number down while the test pattern generator rounds it up, + * so the generator writes one line past the end of the buffer. + * Round the height down to keep both in sync. + */ + for (p = 0; p < fmt->planes; p++) + vdiv = max(vdiv, fmt->vdownsampling[p]); + mp->height = rounddown(mp->height, vdiv); + /* This driver supports custom bytesperline values */ mp->num_planes = fmt->buffers; -- 2.53.0