Unverified Commit b45b3c25 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11477 Fix CVE-2023-52916 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ye Bin <yebin10@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/CGKNTTSRKJ3XHRLHWT5QNAGMYOKWA7HA/ 
Jammy Huang (2):
  media: aspeed: Fix no complete irq for non-64-aligned width
  media: aspeed: Fix memory overwrite if timing is 1600x900


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAPHCN 
 
Link:https://gitee.com/openeuler/kernel/pulls/11477

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 5ea90b2b 78e03fd3

drivers/media/platform/aspeed-video.c

+10 −9
Original line number Diff line number Diff line
@@ -862,23 +862,24 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) 
static void aspeed_video_set_resolution(struct aspeed_video *video)

{

	struct v4l2_bt_timings *act = &video->active_timings;

	unsigned int size = act->width * act->height;

	unsigned int size = act->width * ALIGN(act->height, 8);



	/* Set capture/compression frame sizes */

	aspeed_video_calc_compressed_size(video, size);



	if (video->active_timings.width == 1680) {

	if (!IS_ALIGNED(act->width, 64)) {

		/*

		 * This is a workaround to fix a silicon bug on A1 and A2

		 * revisions. Since it doesn't break capturing operation of

		 * This is a workaround to fix a AST2500 silicon bug on A1 and

		 * A2 revisions. Since it doesn't break capturing operation of

		 * other revisions, use it for all revisions without checking

		 * the revision ID. It picked 1728 which is a very next

		 * 64-pixels aligned value to 1680 to minimize memory bandwidth

		 * the revision ID. It picked new width which is a very next

		 * 64-pixels aligned value to minimize memory bandwidth

		 * and to get better access speed from video engine.

		 */

		aspeed_video_write(video, VE_CAP_WINDOW,

				   1728 << 16 | act->height);

		size += (1728 - 1680) * video->active_timings.height;

		u32 width = ALIGN(act->width, 64);



		aspeed_video_write(video, VE_CAP_WINDOW, width << 16 | act->height);

		size = width * ALIGN(act->height, 8);

	} else {

		aspeed_video_write(video, VE_CAP_WINDOW,

				   act->width << 16 | act->height);