lkml.org 
[lkml]   [2018]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 293/361] media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Hans Verkuil <hverkuil@xs4all.nl>

    commit 250854eed5d45a73d81e4137dfd85180af6f2ec3 upstream.

    When the OSD is on (i.e. vivid displays text on top of the test pattern), and
    you enable hflip, then the driver crashes.

    The cause turned out to be a division of a negative number by an unsigned value.
    You expect that -8 / 2U would be -4, but in reality it is 2147483644 :-(

    Fixes: 3e14e7a82c1ef ("vivid-tpg: add hor/vert downsampling support to tpg_gen_text")

    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Reported-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Cc: <stable@vger.kernel.org> # for v4.1 and up
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
    +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
    @@ -1770,7 +1770,7 @@ typedef struct { u16 __; u8 _; } __packe
    pos[7] = (chr & (0x01 << 0) ? fg : bg); \
    } \
    \
    - pos += (tpg->hflip ? -8 : 8) / hdiv; \
    + pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \
    } \
    } \
    } while (0)

    \
     
     \ /
      Last update: 2018-11-12 00:52    [W:2.228 / U:0.744 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site