media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com
[ Upstream commit e3b86f4e558cea9eed71d894df2f19b10d60a207 ] On the case tmp_dcim=1, the index of buffer is miscalculated. This generate a NULL pointer dereference later. So let's fix the calcul and add a check to prevent this to reappear. Signed-off-by: Corentin Labbe <clabbe@baylibre.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:

committed by
Greg Kroah-Hartman

parent
bd01629315
commit
bafec1a6ba
@@ -879,7 +879,7 @@ static void zoran_reap_stat_com(struct zoran *zr)
|
|||||||
if (zr->jpg_settings.tmp_dcm == 1)
|
if (zr->jpg_settings.tmp_dcm == 1)
|
||||||
i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM;
|
i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM;
|
||||||
else
|
else
|
||||||
i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1;
|
i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2;
|
||||||
|
|
||||||
stat_com = le32_to_cpu(zr->stat_com[i]);
|
stat_com = le32_to_cpu(zr->stat_com[i]);
|
||||||
if ((stat_com & 1) == 0) {
|
if ((stat_com & 1) == 0) {
|
||||||
@@ -891,6 +891,11 @@ static void zoran_reap_stat_com(struct zoran *zr)
|
|||||||
size = (stat_com & GENMASK(22, 1)) >> 1;
|
size = (stat_com & GENMASK(22, 1)) >> 1;
|
||||||
|
|
||||||
buf = zr->inuse[i];
|
buf = zr->inuse[i];
|
||||||
|
if (!buf) {
|
||||||
|
spin_unlock_irqrestore(&zr->queued_bufs_lock, flags);
|
||||||
|
pci_err(zr->pci_dev, "No buffer at slot %d\n", i);
|
||||||
|
return;
|
||||||
|
}
|
||||||
buf->vbuf.vb2_buf.timestamp = ktime_get_ns();
|
buf->vbuf.vb2_buf.timestamp = ktime_get_ns();
|
||||||
|
|
||||||
if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) {
|
if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) {
|
||||||
|
Reference in New Issue
Block a user