Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit c7cbef1f authored by Yong Zhi's avatar Yong Zhi Committed by Mauro Carvalho Chehab
Browse files

media: intel-ipu3: cio2: fix a crash with out-of-bounds access



When dmabuf is used for BLOB type frame, the frame
buffers allocated by gralloc will hold more pages
than the valid frame data due to height alignment.

In this case, the page numbers in sg list could exceed the
FBPT upper limit value - max_lops(8)*1024 to cause crash.

Limit the LOP access to the valid data length
to avoid FBPT sub-entries overflow.

Signed-off-by: default avatarYong Zhi <yong.zhi@intel.com>
Signed-off-by: default avatarCao Bing Bu <bingbu.cao@intel.com>
Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 883dd4c1
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment