github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: nxp: imx8-isi: Fix potential out-of-bounds issues

Browse Source 
The maximum downscaling factor supported by ISI can be up to 16. Add
minimum value constraint before applying the setting to hardware.
Otherwise, the process will not respond even when Ctrl+C is executed.

Fixes: cf21f328fc ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Guoniu Zhou <guoniu.zhou@nxp.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patch.msgid.link/20260323-isi-v3-1-8df53b24e622@oss.nxp.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Guoniu Zhou 2026-03-23 16:33:30 +08:00 committed by Hans Verkuil
parent 75a54af91f
commit 57a7ec5c9f
3 changed files with 32 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/media/platform/nxp/imx8-isi/imx8-isi-core.h
View File

@ -11,6 +11,7 @@
#define __MXC_ISI_CORE_H__
#include <linux/list.h>
#include <linux/math.h>
#include <linux/mutex.h>
#include <linux/spinlock.h>
#include <linux/types.h>
@ -414,4 +415,19 @@ static inline void mxc_isi_debug_cleanup(struct mxc_isi_dev *isi)
}
#endif
/*
* ISI scaling engine works in two parts: it performs pre-decimation of
* the image followed by bilinear filtering to achieve the desired
* downscaling factor.
*
* The decimation filter provides a maximum downscaling factor of 8, and
* the subsequent bilinear filter provides a maximum downscaling factor
* of 2. Combined, the maximum scaling factor can be up to 16.
*/
static inline unsigned int
mxc_isi_clamp_downscale_16(unsigned int val, unsigned int max_val)
{
return clamp(val, max(1U, DIV_ROUND_UP(max_val, 16)), max_val);
}
#endif /* __MXC_ISI_CORE_H__ */

11
drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c
View File

@ -509,9 +509,14 @@ __mxc_isi_m2m_try_fmt_vid(struct mxc_isi_m2m_ctx *ctx,
const enum mxc_isi_video_type type)
{
if (type == MXC_ISI_VIDEO_M2M_CAP) {
/* Downscaling only */
pix->width = min(pix->width, ctx->queues.out.format.width);
pix->height = min(pix->height, ctx->queues.out.format.height);
const struct v4l2_pix_format_mplane *format =
&ctx->queues.out.format;
/* Downscaling only, by up to 16. */
pix->width = mxc_isi_clamp_downscale_16(pix->width,
format->width);
pix->height = mxc_isi_clamp_downscale_16(pix->height,
format->height);
}
return mxc_isi_format_try(ctx->m2m->pipe, pix, type);

13
drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c
View File

@ -641,16 +641,19 @@ static int mxc_isi_pipe_set_selection(struct v4l2_subdev *sd,
/* Composing is supported on the sink only. */
return -EINVAL;
/* The sink crop is bound by the sink format downscaling only). */
/*
* The ISI supports downscaling only, with a factor up to 16.
* Clamp the compose rectangle size accordingly.
*/
format = mxc_isi_pipe_get_pad_format(pipe, state,
MXC_ISI_PIPE_PAD_SINK);
sel->r.left = 0;
sel->r.top = 0;
sel->r.width = clamp(sel->r.width, MXC_ISI_MIN_WIDTH,
format->width);
sel->r.height = clamp(sel->r.height, MXC_ISI_MIN_HEIGHT,
format->height);
sel->r.width = mxc_isi_clamp_downscale_16(sel->r.width,
format->width);
sel->r.height = mxc_isi_clamp_downscale_16(sel->r.height,
format->height);
rect = mxc_isi_pipe_get_pad_compose(pipe, state,
MXC_ISI_PIPE_PAD_SINK);