diff options
| author | Praveen Kumar Reddy M.V <pkreddy@nvidia.com> | 2016-06-13 17:08:32 +0530 |
|---|---|---|
| committer | Matthew Pedro <mapedro@nvidia.com> | 2016-09-06 21:36:39 -0700 |
| commit | cd9b8bf34e7d601896c8c019b956feddf56871d6 (patch) | |
| tree | 70fa15e40a23907b758f4d306ba701d3a9f12a70 /drivers/media | |
| parent | 70ae2d44a04c5a3cd5b036d5a5181ddce5cd5fc8 (diff) | |
tegra:nvavp: Fix buffer overflow issue
Fixed possible buffer overflow issue in func
nvavp_pushbuffer_update().
Bug 1774401
Change-Id: Id0dec1cbf91d492335d0809c3c0bf146f6cb9d3d
Signed-off-by: Praveen Kumar Reddy M.V. <pkreddy@nvidia.com>
Reviewed-on: http://git-master/r/1163365
(cherry picked from commit 1e9ba50b225e841b52a93503fce818c1a21100f7)
Reviewed-on: http://git-master/r/1164130
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/platform/tegra/nvavp/nvavp_dev.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/platform/tegra/nvavp/nvavp_dev.c b/drivers/media/platform/tegra/nvavp/nvavp_dev.c index 843ea338c949..05c5f997e12f 100644 --- a/drivers/media/platform/tegra/nvavp/nvavp_dev.c +++ b/drivers/media/platform/tegra/nvavp/nvavp_dev.c @@ -871,6 +871,7 @@ static int nvavp_pushbuffer_update(struct nvavp_info *nvavp, u32 phys_addr, u32 wordcount = 0; u32 index, value = -1; int ret = 0; + u32 max_index = 0; mutex_lock(&nvavp->open_lock); nvavp_runtime_get(nvavp); @@ -885,7 +886,9 @@ static int nvavp_pushbuffer_update(struct nvavp_info *nvavp, u32 phys_addr, mutex_lock(&channel_info->pushbuffer_lock); /* check for pushbuffer wrapping */ - if (channel_info->pushbuf_index >= channel_info->pushbuf_fence) + max_index = channel_info->pushbuf_fence; + max_index = ext_ucode_flag ? max_index : max_index - (sizeof(u32) * 4); + if (channel_info->pushbuf_index >= max_index) channel_info->pushbuf_index = 0; if (!ext_ucode_flag) { |