github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-01 19:13:47 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: bcm2835-unicam: Fix for possible dummy buffer overrun

Browse Source 
The Unicam hardware has been observed to cause a buffer overrun when
using the dummy buffer as a circular buffer. The conditions that cause
the overrun are not fully known, but it seems to occur when the memory
bus is heavily loaded.

To avoid the overrun, program the hardware with a buffer size of 0 when
using the dummy buffer. This will cause overrun into the allocated dummy
buffer, but avoid out of bounds writes.

Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Naushir Patuck 2024-11-27 11:15:15 +00:00 committed by Mauro Carvalho Chehab
parent 697a252bb2
commit 7b1ec3e389
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/media/platform/broadcom/bcm2835-unicam.c
View File

@ -640,7 +640,14 @@ static inline void unicam_reg_write_field(struct unicam_device *unicam, u32 offs
static void unicam_wr_dma_addr(struct unicam_node *node,
struct unicam_buffer *buf)
{
dma_addr_t endaddr = buf->dma_addr + buf->size;
/*
* Due to a HW bug causing buffer overruns in circular buffer mode under
* certain (not yet fully known) conditions, the dummy buffer allocation
* is set to a a single page size, but the hardware gets programmed with
* a buffer size of 0.
*/
dma_addr_t endaddr = buf->dma_addr +
(buf != &node->dummy_buf ? buf->size : 0);
if (node->id == UNICAM_IMAGE_NODE) {
unicam_reg_write(node->dev, UNICAM_IBSA0, buf->dma_addr);