Re: [PATCH v3 03/11] media: videobuf2: Remove VB2_MAX_FRAME limit on buffer storage
From: Dan Carpenter <hidden>
Date: 2023-06-22 14:11:37
Also in:
linux-arm-msm, linux-media, linux-rockchip, linux-staging, lkml
On Thu, Jun 22, 2023 at 03:13:41PM +0200, Benjamin Gaignard wrote:
quoted hunk ↗ jump to hunk
diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c index f1ff7af34a9f..86e1e926fa45 100644 --- a/drivers/media/common/videobuf2/videobuf2-core.c +++ b/drivers/media/common/videobuf2/videobuf2-core.c@@ -455,9 +455,9 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory, struct vb2_buffer *vb; int ret; - /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */ + /* Ensure that q->num_buffers + num_buffers is UINT_MAX */ num_buffers = min_t(unsigned int, num_buffers, - VB2_MAX_FRAME - q->num_buffers); + UINT_MAX - q->num_buffers); for (buffer = 0; buffer < num_buffers; ++buffer) { /* Allocate vb2 buffer structures */
Ah... Here's one of the integer overflow bugs I was talking about. The __vb2_queue_alloc() function returns an int so if num_buffers goes over INT_MAX we are hosed. regards, dan carpenter _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel