From patchwork Mon Oct 17 14:46:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Verkuil X-Patchwork-Id: 3490 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp1492488wrs; Mon, 17 Oct 2022 07:54:25 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6eL9jhsArgvNlPEbJqHNq9pADJ8l4t3nO8kg6P3Zo+2gU7TLTGdW5iYGrQLZicfZgSCh4d X-Received: by 2002:a17:907:e91:b0:782:607a:8dc9 with SMTP id ho17-20020a1709070e9100b00782607a8dc9mr9176699ejc.729.1666018465269; Mon, 17 Oct 2022 07:54:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666018465; cv=none; d=google.com; s=arc-20160816; b=LQQBwoQ3VMiqANuAcm0GqriFsEm+P6b9ccyzp11Ys1O/MNhTswpkgA/QJPrn5kynos OdowVZO54qblXNGAmfn2dzaBdBSuDTUJl9MUcmfSZGl4mq4YutRtsquAEyk2CvlJJ/+y XK1A7+okfVtGnPDinTkAIpXuOLvVNJZGMdQ+CuAdaW0Qfi6ZlO+IK7/E9rogKZef8j7Z ZWZtigIH+XJKgkvayYwGWmIXr7pKAWlxzCHakrEeqytYBNqpPaiWGgQenvs6VdbpSDkj S3NwtsfkQ9iOOgziXtBJNF7HiNCP7hfSCt1aph7WqwT2YwAyWo/tSUwDEE2QZC2QDVdP 9MQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=XwoUfHaYj7x3a4x+hCRNVcGNhbpVK/o3UT//ZcMOsi8=; b=FSEkR/pfb1ql/LadxURf4ht2DR57i1ejUI1sAHgZtrtmvzS73ZaZe251LjBC7kBvXL nV47f7IefZGQTk5Ve5CHBNg78E9Ta9dUOlyf/uOcQazASajaMeWVe+lhqgW3jNj51XfC SiJIUEAQccIPl/3RfE7Otx+hhxrBMCwDNkU0lzenKF/b4X1v2j0oqGVtC/LEqHYyPt98 ryqX1cLO+YV0jNDBpoxyREMvWiSjNmgDUIzCr0D9eiNbKGFXzUBx1K70Xy9CDPEciHC4 YyezkMZASJWrN5sZCwNNEE3D/4CR3j/uRyPd/dNlOThvC3JfstL0RO4QGMQT6ORgwT8x oZgg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id g8-20020a056402090800b0045c7611d8ddsi10134986edz.179.2022.10.17.07.53.59; Mon, 17 Oct 2022 07:54:25 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229794AbiJQOqk (ORCPT + 99 others); Mon, 17 Oct 2022 10:46:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41484 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229848AbiJQOqf (ORCPT ); Mon, 17 Oct 2022 10:46:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3443D67143; Mon, 17 Oct 2022 07:46:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BD9476118E; Mon, 17 Oct 2022 14:46:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A9AFC433D6; Mon, 17 Oct 2022 14:46:31 +0000 (UTC) From: Hans Verkuil To: linux-media@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hans Verkuil Subject: [PATCH for 6.1 1/4] vivid: s_fbuf: add more sanity checks Date: Mon, 17 Oct 2022 16:46:25 +0200 Message-Id: <20221017144628.489271-2-hverkuil-cisco@xs4all.nl> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> References: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> MIME-Version: 1.0 X-Spam-Status: No, score=-6.7 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746946978086091887?= X-GMAIL-MSGID: =?utf-8?q?1746946978086091887?= VIDIOC_S_FBUF is by definition a scary ioctl, which is why only root can use it. But at least check if the framebuffer parameters match that of one of the framebuffer created by vivid, and reject anything else. Signed-off-by: Hans Verkuil Fixes: ef834f7836ec ([media] vivid: add the video capture and output parts) --- drivers/media/test-drivers/vivid/vivid-core.c | 22 +++++++++++++++++++ drivers/media/test-drivers/vivid/vivid-core.h | 2 ++ .../media/test-drivers/vivid/vivid-vid-cap.c | 9 +++++++- 3 files changed, 32 insertions(+), 1 deletion(-) diff --git a/drivers/media/test-drivers/vivid/vivid-core.c b/drivers/media/test-drivers/vivid/vivid-core.c index 04b75666bad4..61d48fbc3d15 100644 --- a/drivers/media/test-drivers/vivid/vivid-core.c +++ b/drivers/media/test-drivers/vivid/vivid-core.c @@ -339,6 +339,28 @@ static int vidioc_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *a return vivid_vid_out_g_fbuf(file, fh, a); } +/* + * Only support the framebuffer of one of the vivid instances. + * Anything else is rejected. + */ +bool vivid_validate_fb(const struct v4l2_framebuffer *a) +{ + struct vivid_dev *dev; + int i; + + for (i = 0; i < n_devs; i++) { + dev = vivid_devs[i]; + if (!dev || !dev->video_pbase) + continue; + if ((unsigned long)a->base == dev->video_pbase && + a->fmt.width <= dev->display_width && + a->fmt.height <= dev->display_height && + a->fmt.bytesperline <= dev->display_byte_stride) + return true; + } + return false; +} + static int vidioc_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffer *a) { struct video_device *vdev = video_devdata(file); diff --git a/drivers/media/test-drivers/vivid/vivid-core.h b/drivers/media/test-drivers/vivid/vivid-core.h index bfcfb3515901..473f3598db5a 100644 --- a/drivers/media/test-drivers/vivid/vivid-core.h +++ b/drivers/media/test-drivers/vivid/vivid-core.h @@ -613,4 +613,6 @@ static inline bool vivid_is_hdmi_out(const struct vivid_dev *dev) return dev->output_type[dev->output] == HDMI; } +bool vivid_validate_fb(const struct v4l2_framebuffer *a); + #endif diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index 86b158eeb2d8..e3e78b5bd227 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -1276,7 +1276,14 @@ int vivid_vid_cap_s_fbuf(struct file *file, void *fh, return -EINVAL; if (a->fmt.bytesperline < (a->fmt.width * fmt->bit_depth[0]) / 8) return -EINVAL; - if (a->fmt.height * a->fmt.bytesperline < a->fmt.sizeimage) + if (a->fmt.bytesperline > a->fmt.sizeimage / a->fmt.height) + return -EINVAL; + + /* + * Only support the framebuffer of one of the vivid instances. + * Anything else is rejected. + */ + if (!vivid_validate_fb(a)) return -EINVAL; dev->fb_vbase_cap = phys_to_virt((unsigned long)a->base); From patchwork Mon Oct 17 14:46:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Verkuil X-Patchwork-Id: 3491 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp1492511wrs; Mon, 17 Oct 2022 07:54:27 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5pJUXw/lyf6GQ5RJr9BLcDqyQo+hI219GIUzpXk+CXX1c4hxqhvlsBxuLrNFhR7jvurkoi X-Received: by 2002:a50:fc85:0:b0:458:e7c6:1cfa with SMTP id f5-20020a50fc85000000b00458e7c61cfamr10853896edq.256.1666018467754; Mon, 17 Oct 2022 07:54:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666018467; cv=none; d=google.com; s=arc-20160816; b=NnY1EaVbgGwQZ1VVgtwCtjs2aQGz8WPN6JliDaSkLJCKJU7ZFQ984sXfh9hfK/VRK+ Up+BQPkaE5Khed+KpjTKRIjb+OHBf3dHYCpea6jUAUnDSgX/Ej11Vpi9l4ZkY/Zwlf7/ /GZhEJDJxftOWIQhPZ1hjWlFk3vCdTMAIQIry0do8ZKw/eng+asDj5mkop5zk4A6mf59 uEsHkdtXt0rweNrgdjvT1F2qTM0TkQYbzgRzyfNYW+74uYv4wfzyyEyFKZ7E3sPtmM1T BrgStjNTBn4ajEj2PbvAq1Z/o0EoieRy8u61d6ye7dnf7562Mkjrldh6BtNSKpaB4mhd 0TaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=FaLkMLMnSIhoYvqJJgNBDkifdbLoYx0RKTJ9nWcwiLI=; b=wWrOyt9O+PEa3/8ZG3KmoG0dGBhYw1t3XR1PT66FhbqVG9RTnXSbKHfCC3Ifw0ixoo Mwd+cF0KFbaKJSv6EQ+N271epQHDz9vHhn4yxcILsm26SPCfLyAJOG7pvvph0+rs2owU gp+p5jHGY3OBGWrrSUD3mYu6Cq8dGhkewHwWT1fD+Vkrg4ceoeBzDh+5U/GAledSRgV6 kKkPXnVxm1htHSJlYHhDWNUN9QVlF9a2PgH+82Fr2xIJ5VKHdHvKebxd2stGNmE6Ty8D iZhn59G//YpjB7DBUGU9X2wp3oJupMbtMQdsgh6gH7x8Gdd/hIN9dAcZumDvRnKsgV+O YXMQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id g15-20020a1709065d0f00b007306ac0faa0si9762939ejt.615.2022.10.17.07.54.02; Mon, 17 Oct 2022 07:54:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231143AbiJQOqp (ORCPT + 99 others); Mon, 17 Oct 2022 10:46:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41488 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230053AbiJQOqf (ORCPT ); Mon, 17 Oct 2022 10:46:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9921C36DF5; Mon, 17 Oct 2022 07:46:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DF03C6118F; Mon, 17 Oct 2022 14:46:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 900DFC433D7; Mon, 17 Oct 2022 14:46:32 +0000 (UTC) From: Hans Verkuil To: linux-media@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hans Verkuil Subject: [PATCH for 6.1 2/4] vivid: dev->bitmap_cap wasn't freed in all cases Date: Mon, 17 Oct 2022 16:46:26 +0200 Message-Id: <20221017144628.489271-3-hverkuil-cisco@xs4all.nl> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> References: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> MIME-Version: 1.0 X-Spam-Status: No, score=-6.7 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746946980530446617?= X-GMAIL-MSGID: =?utf-8?q?1746946980530446617?= Whenever the compose width/height values change, the dev->bitmap_cap vmalloc'ed array must be freed and dev->bitmap_cap set to NULL. This was done in some places, but not all. This is only an issue if overlay support is enabled and the bitmap clipping is used. Signed-off-by: Hans Verkuil Fixes: ef834f7836ec ([media] vivid: add the video capture and output parts) --- .../media/test-drivers/vivid/vivid-vid-cap.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/media/test-drivers/vivid/vivid-vid-cap.c b/drivers/media/test-drivers/vivid/vivid-vid-cap.c index e3e78b5bd227..d52d24b61d34 100644 --- a/drivers/media/test-drivers/vivid/vivid-vid-cap.c +++ b/drivers/media/test-drivers/vivid/vivid-vid-cap.c @@ -453,6 +453,12 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls) tpg_reset_source(&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap); dev->crop_cap = dev->src_rect; dev->crop_bounds_cap = dev->src_rect; + if (dev->bitmap_cap && + (dev->compose_cap.width != dev->crop_cap.width || + dev->compose_cap.height != dev->crop_cap.height)) { + vfree(dev->bitmap_cap); + dev->bitmap_cap = NULL; + } dev->compose_cap = dev->crop_cap; if (V4L2_FIELD_HAS_T_OR_B(dev->field_cap)) dev->compose_cap.height /= 2; @@ -913,6 +919,8 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection struct vivid_dev *dev = video_drvdata(file); struct v4l2_rect *crop = &dev->crop_cap; struct v4l2_rect *compose = &dev->compose_cap; + unsigned orig_compose_w = compose->width; + unsigned orig_compose_h = compose->height; unsigned factor = V4L2_FIELD_HAS_T_OR_B(dev->field_cap) ? 2 : 1; int ret; @@ -1029,17 +1037,17 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection s->r.height /= factor; } v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect); - if (dev->bitmap_cap && (compose->width != s->r.width || - compose->height != s->r.height)) { - vfree(dev->bitmap_cap); - dev->bitmap_cap = NULL; - } *compose = s->r; break; default: return -EINVAL; } + if (dev->bitmap_cap && (compose->width != orig_compose_w || + compose->height != orig_compose_h)) { + vfree(dev->bitmap_cap); + dev->bitmap_cap = NULL; + } tpg_s_crop_compose(&dev->tpg, crop, compose); return 0; } From patchwork Mon Oct 17 14:46:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Verkuil X-Patchwork-Id: 3492 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp1492541wrs; Mon, 17 Oct 2022 07:54:31 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7y5GlwzHhp9T7Uq3pH27XVyPBgpf8ZMiuMC+dJovhWEKgrBQM+LPuaL0gQJc9t+7UIzP2i X-Received: by 2002:a17:907:980e:b0:78d:b6ea:25b3 with SMTP id ji14-20020a170907980e00b0078db6ea25b3mr8948984ejc.98.1666018471090; Mon, 17 Oct 2022 07:54:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666018471; cv=none; d=google.com; s=arc-20160816; b=Pk8c9aFOSxgFyTSdFawZAJ2iZRFPhYbdBJTnbzHVM6GVU5VIyh/AsxWeHjD4aMGKy5 TALc3ZjQI3Sxz77MWfVM6PJ4kanXxUvja9aa2I6qwcv4QRGaP8+Encl7Vm8+jKbXO5bP WR75QpeZGNNpKJyuY8YOEjt+bmWFewKXzStagl4VtPwsrbB10Mn1ROClDch9jthFho61 m8NGMcQUu1Ah6htyj8XUteogTaiNoQRwXJOdNrXyCkSidEeczxDu/dndaDwftU6kv0XX oik0ryEptd30opiABzbEnjHm1Jz0jnlJGdoOE7u+YFrDLH8qnd5TcAdLiSXzkMcJQ6/b s35w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=JOFdSsdzNRWWH3FeqVv3tkbg0jIDzTWSfvbIMQA23Nk=; b=CWrF2zTet/atXN4vLXTKgrCAa2SWWhGBQmm5xAsm+lNFV7fv1OO0Jy8+fK6OxgueR9 JF6OUtLQ6CZryB09g/k1OwoZHs3n99r+XzfwFQwg404qoSfcwqa6Psx6VvSh64BMpprm RbZsoLZgpLux7zXvZ0GSEk4MvTUW7vS+uUEHB5J2v5ch/yb4DxVFCh4ziQTXkrz1eiXg HLKkVAXocc5tAJvj5tae/QhMqQegRPHgoI+4VOpO3NjCbXtMbpCoY+oyeoPuhAnuZika AjdKlWtC/E5S2Ga28/YDQWeA2kZM21Q1kyKr+e48lab4lLUr7j0OJEYL6TSPR3AEoMrf mLTQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y16-20020a056402359000b0045d15f39bf4si10568929edc.479.2022.10.17.07.54.06; Mon, 17 Oct 2022 07:54:31 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230053AbiJQOqs (ORCPT + 99 others); Mon, 17 Oct 2022 10:46:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230226AbiJQOqg (ORCPT ); Mon, 17 Oct 2022 10:46:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 704BA65836; Mon, 17 Oct 2022 07:46:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0FEEC61190; Mon, 17 Oct 2022 14:46:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5A75C433C1; Mon, 17 Oct 2022 14:46:33 +0000 (UTC) From: Hans Verkuil To: linux-media@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hans Verkuil Subject: [PATCH for 6.1 3/4] v4l2-dv-timings: add sanity checks for blanking values Date: Mon, 17 Oct 2022 16:46:27 +0200 Message-Id: <20221017144628.489271-4-hverkuil-cisco@xs4all.nl> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> References: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> MIME-Version: 1.0 X-Spam-Status: No, score=-6.7 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746946984394029807?= X-GMAIL-MSGID: =?utf-8?q?1746946984394029807?= Add sanity checks to v4l2_valid_dv_timings() to ensure that the provided blanking values are reasonable. Signed-off-by: Hans Verkuil Fixes: b18787ed1ce3 ([media] v4l2-dv-timings: add new helper module) --- drivers/media/v4l2-core/v4l2-dv-timings.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c index af48705c704f..003c32fed3f7 100644 --- a/drivers/media/v4l2-core/v4l2-dv-timings.c +++ b/drivers/media/v4l2-core/v4l2-dv-timings.c @@ -161,6 +161,20 @@ bool v4l2_valid_dv_timings(const struct v4l2_dv_timings *t, (bt->interlaced && !(caps & V4L2_DV_BT_CAP_INTERLACED)) || (!bt->interlaced && !(caps & V4L2_DV_BT_CAP_PROGRESSIVE))) return false; + + /* sanity checks for the blanking timings */ + if (!bt->interlaced && + (bt->il_vbackporch || bt->il_vsync || bt->il_vfrontporch)) + return false; + if (bt->hfrontporch > 2 * bt->width || + bt->hsync > 1024 || bt->hbackporch > 1024) + return false; + if (bt->vfrontporch > 4096 || + bt->vsync > 128 || bt->vbackporch > 4096) + return false; + if (bt->interlaced && (bt->il_vfrontporch > 4096 || + bt->il_vsync > 128 || bt->il_vbackporch > 4096)) + return false; return fnc == NULL || fnc(t, fnc_handle); } EXPORT_SYMBOL_GPL(v4l2_valid_dv_timings); From patchwork Mon Oct 17 14:46:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hans Verkuil X-Patchwork-Id: 3493 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp1492550wrs; Mon, 17 Oct 2022 07:54:32 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6RHflr8sB74KrFz5MwcIq2YhhLNjqGEEo6zt1M5pPp2KJT5mK6eVX+pXXmrlQXWrITIFtA X-Received: by 2002:a17:907:808:b0:730:54cc:b597 with SMTP id wv8-20020a170907080800b0073054ccb597mr9049407ejb.434.1666018472025; Mon, 17 Oct 2022 07:54:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666018472; cv=none; d=google.com; s=arc-20160816; b=Pbn8y1IHWdGqPkS16uL6IiQ3PKtlX5+h6vLVVrMHoIUSwsW9PUKUkEC31TF1LGS2CJ QdcMTu7JWllUemb6kXz/BioN5Ma+8CM6VsUGcJj16ms03UZPbnZQVFCAtLWIX33Nu23U mveros+19rhViabUcV24o3Kf5tl4jzGFmxcQrgGnQD8Xz7gVJU0hiP+PZ1AMPCIX84SB +ivsbfT3V/wxKw0HLBWuHr9Hq+RLvacc0ygh7FpF3cPLO8wB7gJn1wYNcHKc2idX1SoT MNxQSEEaJLiQDQ0FQ4CPmJsNk1dk2NFydcZ1NqYBRwNxaa1qq2g7HlQ6w/Jd+Xa27CEB FKdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=RTwH9rDSc+7MGp5aECyDE0cQ4BYzs55uWewRc65fQaM=; b=LOCz/cPEQEDdvVb5CJZrL7ViFAhBzoc5CPnPBOyyTwGNE+oKuIxGWC5oQBLscN1F8e 7Ww5OALtM62kanqI/mxOYvT7YtoTyiF1Dx0x4ifxPWe5TdNFz7SM71TwS7wgaXDNdCta NpScA8ft/8BFPT2PSVGbCurZZIvmgL/tN4MsLgKMo8ADhxwxgl6RTSBfCrNBbTArMrJD 99wRuktLRPdlriVhgTBWVuZ0uKYfMI7gy2CgdxGAKM4CgjcFZNmZaIIFGkQKE+HSROV5 muhzGzdmnymPQyOKdrgaWOCaq3t/M/636fjuVASkbHD0TWKFYSy75Jo5S+tQi+JiHUsp 8stA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s16-20020a50d490000000b0045cd50b7c65si8299064edi.266.2022.10.17.07.54.06; Mon, 17 Oct 2022 07:54:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xs4all.nl Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230416AbiJQOqw (ORCPT + 99 others); Mon, 17 Oct 2022 10:46:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230525AbiJQOqi (ORCPT ); Mon, 17 Oct 2022 10:46:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25B0029C9F; Mon, 17 Oct 2022 07:46:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D8FC2B81637; Mon, 17 Oct 2022 14:46:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB063C433B5; Mon, 17 Oct 2022 14:46:34 +0000 (UTC) From: Hans Verkuil To: linux-media@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hans Verkuil Subject: [PATCH for 6.1 4/4] videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' Date: Mon, 17 Oct 2022 16:46:28 +0200 Message-Id: <20221017144628.489271-5-hverkuil-cisco@xs4all.nl> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> References: <20221017144628.489271-1-hverkuil-cisco@xs4all.nl> MIME-Version: 1.0 X-Spam-Status: No, score=-6.7 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746946985730320642?= X-GMAIL-MSGID: =?utf-8?q?1746946985730320642?= If it is a progressive (non-interlaced) format, then ignore the interlaced timing values. Signed-off-by: Hans Verkuil Fixes: 7f68127fa11f ([media] videodev2.h: defines to calculate blanking and frame sizes) --- include/uapi/linux/videodev2.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h index 86cae23cc446..29da1f4b4578 100644 --- a/include/uapi/linux/videodev2.h +++ b/include/uapi/linux/videodev2.h @@ -1601,7 +1601,8 @@ struct v4l2_bt_timings { ((bt)->width + V4L2_DV_BT_BLANKING_WIDTH(bt)) #define V4L2_DV_BT_BLANKING_HEIGHT(bt) \ ((bt)->vfrontporch + (bt)->vsync + (bt)->vbackporch + \ - (bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) + ((bt)->interlaced ? \ + ((bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) : 0)) #define V4L2_DV_BT_FRAME_HEIGHT(bt) \ ((bt)->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))