Commit 78e03fd3 authored by Jammy Huang's avatar Jammy Huang Committed by Ye Bin
Browse files

media: aspeed: Fix memory overwrite if timing is 1600x900 

mainline inclusion
from mainline-v6.6-rc1
commit c2813550
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAPHCN
CVE: CVE-2023-52916

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c281355068bc258fd619c5aefd978595bede7bfe



--------------------------------

When capturing 1600x900, system could crash when system memory usage is
tight.

The way to reproduce this issue:
1. Use 1600x900 to display on host
2. Mount ISO through 'Virtual media' on OpenBMC's web
3. Run script as below on host to do sha continuously
  #!/bin/bash
  while [ [1] ];
  do
	find /media -type f -printf '"%h/%f"\n' | xargs sha256sum
  done
4. Open KVM on OpenBMC's web

The size of macro block captured is 8x8. Therefore, we should make sure
the height of src-buf is 8 aligned to fix this issue.

Signed-off-by: default avatarJammy Huang <jammy_huang@aspeedtech.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>

Conflicts:
	drivers/media/platform/aspeed-video.c
	drivers/media/platform/aspeed/aspeed-video.c
[As aspeed-video.c moved to aspeed directory]

Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
parent dd97bf91

drivers/media/platform/aspeed-video.c

+2 −2
Original line number Diff line number Diff line
@@ -862,7 +862,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) 
static void aspeed_video_set_resolution(struct aspeed_video *video)

{

	struct v4l2_bt_timings *act = &video->active_timings;

	unsigned int size = act->width * act->height;

	unsigned int size = act->width * ALIGN(act->height, 8);



	/* Set capture/compression frame sizes */

	aspeed_video_calc_compressed_size(video, size);
@@ -879,7 +879,7 @@ static void aspeed_video_set_resolution(struct aspeed_video *video) 
		u32 width = ALIGN(act->width, 64);



		aspeed_video_write(video, VE_CAP_WINDOW, width << 16 | act->height);

		size = width * act->height;

		size = width * ALIGN(act->height, 8);

	} else {

		aspeed_video_write(video, VE_CAP_WINDOW,

				   act->width << 16 | act->height);