diff options
| author | Rui Miguel Silva <rui.silva@linaro.org> | 2018-05-08 12:04:07 +0100 |
|---|---|---|
| committer | Rui Miguel Silva <rui.silva@linaro.org> | 2018-05-08 12:04:07 +0100 |
| commit | 7f2c43c0a4721ab7163c190fc25913574950f141 (patch) | |
| tree | 4e67b3baa7da129de3f652b22e92cd57e9d71922 | |
| parent | 8eface1b76ddc408a96eae4cac15bf49fba0e9eb (diff) | |
staging: media: imx7: fix possible memory corruption in csimbl_v4.14.12-6linaro-20180508-001
The fifo pixel copy is done based on image parameters, when the bit_pixel is set
we say already that the pixel size is 16bits, so we need to pass the real width
and not a byte per pixel width. This would avoid the copy over the allocated
buffers.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
| -rw-r--r-- | drivers/staging/media/imx/imx7-media-csi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c index 11a1cb1d8a62..3ad5cef722d0 100644 --- a/drivers/staging/media/imx/imx7-media-csi.c +++ b/drivers/staging/media/imx/imx7-media-csi.c @@ -525,7 +525,7 @@ static void csi_set_imagpara(struct imx7_csi_dev *csi, int width, int height) int imag_para = 0; unsigned long cr3 = __raw_readl(csi->regbase + CSI_CSICR3); - imag_para = (width << 16) | height; + imag_para = (width / 2 << 16) | height; __raw_writel(imag_para, csi->regbase + CSI_CSIIMAG_PARA); /* reflash the embedded DMA controller */ |