[PATCH] OOB read and write in mdp_prepare_buffer

[sun yq]

Hi,
Because there are many functions using the plane, increasing the max
number of the plane is to maximize the solution to all possible oob
places.

On Tue, Jun 27, 2023 at 10:06 PM Alain Volmat <alain.volmat at foss.st.com> wrote:
>
> Hi,
>
> On Tue, Jun 27, 2023 at 04:27:31PM +0800, yqsun1997 at gmail.com wrote:
> > From: yqsun1997 <yqsun1997 at gmail.com>
> >
> > Because format in struct img_image_buffer max index is IMG_MAX_PLANES ==3,
> > The num_planes max index is 8.so will be OOB like in mdp_prepare_buffer.
>
> Similarly as your other patch, could you describe why you need to
> increase the IMG_MAX_PLANES while I suspect your driver only needs to
> deal with 3 planes.  While the maximum num_planes value that can be
> given by the user is 8, this has to be first compared to the configured
> format prior to reaching this function.
>
> >
> > static void mdp_prepare_buffer(struct img_image_buffer *b,
> >                                struct mdp_frame *frame, struct vb2_buffer *vb)
> > {
> >         struct v4l2_pix_format_mplane *pix_mp = &frame->format.fmt.pix_mp;
> >         unsigned int i;
> >
> >         b->format.colorformat = frame->mdp_fmt->mdp_color;
> >         b->format.ycbcr_prof = frame->ycbcr_prof;
> >         for (i = 0; i < pix_mp->num_planes; ++i) {
> >                 u32 stride = mdp_fmt_get_stride(frame->mdp_fmt,
> >                         pix_mp->plane_fmt[i].bytesperline, i);
> >
> >                 b->format.plane_fmt[i].stride = stride;  //oob
> >                 ......
> >
> > Signed-off-by: yqsun1997 <yqsun1997 at gmail.com>
> > ---
> >  drivers/media/platform/mediatek/mdp3/mtk-mdp3-type.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-type.h b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-type.h
> > index ae0396806..e2e991a34 100644
> > --- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-type.h
> > +++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-type.h
> > @@ -11,7 +11,7 @@
> >
> >  #define IMG_MAX_HW_INPUTS    3
> >  #define IMG_MAX_HW_OUTPUTS   4
> > -#define IMG_MAX_PLANES               3
> > +#define IMG_MAX_PLANES               8
> >  #define IMG_MAX_COMPONENTS   20
> >
> >  struct img_crop {
> > --
> > 2.39.2
> >
>
> Regards,
> Alain