[PATCH] media: cobalt: bound the dv timings to the descriptor buffers

[Guo Zihao]

media: cobalt: bound the dv timings to the descriptor buffers

The DMA descriptor buffers are sized from the maximum frame the driver
supports:

        const size_t max_pages_per_line =
                (COBALT_MAX_WIDTH * COBALT_MAX_BPP) / PAGE_SIZE + 2;
        const size_t bytes =
                COBALT_MAX_HEIGHT * max_pages_per_line * 0x20;

With COBALT_MAX_WIDTH 1920, COBALT_MAX_HEIGHT 1200 and COBALT_MAX_BPP 3
that is 115200 bytes, or 3600 descriptors of 0x20 bytes each.

cobalt_s_dv_timings() however records whatever the subdevice accepts
without checking it against those maxima:

        err = v4l2_subdev_call(s->sd, pad, s_dv_timings, 0, timings);
        if (!err) {
                s->timings = *timings;
                s->width = timings->bt.width;
                s->height = timings->bt.height;
                s->stride = timings->bt.width * s->bpp;
        }

descriptor_list_create() in cobalt-omnitek.c then walks the whole frame
and writes one descriptor per scatterlist segment, with no upper bound of
its own. An HDMI source at 4096x2160 with bpp 3 gives stride 12288 and
size 26542080, which needs far more than the 3600 descriptors the buffer
holds, so d[] walks off the end of the coherent allocation.

cobalt_try_fmt_vid_cap() and cobalt_try_fmt_vid_out() already cap width
and height at 1920x1080, and this patch adds the same bound for the
timings path plus a stride limit on the pixelformat path.

No Fixes tag. The descriptor sizing and s_dv_timings() both come from the
initial driver, 85756a069c55 ("[media] cobalt: add new driver").

Reviewed-by: Liu Chao <liuc63@xxxxxxxxxxxx>
Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
The timings come from the subdevice, which for the HDMI inputs is the
adv7604/adv7842 receiver, so connecting a source above 1080p is enough
to reach this. That is an ordinary signal, not a crafted one.

The stride limit in cobalt_try_fmt_vid_cap() covers the path where
bytesperline is chosen from userspace rather than derived from the
timings.

 drivers/media/pci/cobalt/cobalt-v4l2.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/media/pci/cobalt/cobalt-v4l2.c b/drivers/media/pci/cobalt/cobalt-v4l2.c
index 51fd9576c..32d967254 100644
--- a/drivers/media/pci/cobalt/cobalt-v4l2.c
+++ b/drivers/media/pci/cobalt/cobalt-v4l2.c
@@ -630,6 +630,13 @@ static int cobalt_s_dv_timings(struct file *file, void *priv,
 	if (vb2_is_busy(&s->q))
 		return -EBUSY;
 
+	if (timings->bt.width > COBALT_MAX_WIDTH ||
+	    timings->bt.height > COBALT_MAX_HEIGHT) {
+		cobalt_info("timings %ux%u out of range\n",
+			    timings->bt.width, timings->bt.height);
+		return -EINVAL;
+	}
+
 	err = v4l2_subdev_call(s->sd,
 			pad, s_dv_timings, 0, timings);
 	if (!err) {
@@ -781,6 +788,14 @@ static int cobalt_try_fmt_vid_cap(struct file *file, void *priv,
 		break;
 	}
 
+	/*
+	 * The DMA descriptor buffers are sized for at most
+	 * COBALT_MAX_WIDTH x COBALT_MAX_HEIGHT, so limit the line stride
+	 * accordingly.
+	 */
+	if (pix->bytesperline > COBALT_MAX_WIDTH * COBALT_MAX_BPP)
+		pix->bytesperline = COBALT_MAX_WIDTH * COBALT_MAX_BPP;
+
 	pix->sizeimage = pix->bytesperline * pix->height;
 	pix->field = V4L2_FIELD_NONE;
 
-- 
2.50.1