| From 250854eed5d45a73d81e4137dfd85180af6f2ec3 Mon Sep 17 00:00:00 2001 |
| From: Hans Verkuil <hverkuil@xs4all.nl> |
| Date: Mon, 8 Oct 2018 15:08:27 -0400 |
| Subject: media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD |
| |
| From: Hans Verkuil <hverkuil@xs4all.nl> |
| |
| commit 250854eed5d45a73d81e4137dfd85180af6f2ec3 upstream. |
| |
| When the OSD is on (i.e. vivid displays text on top of the test pattern), and |
| you enable hflip, then the driver crashes. |
| |
| The cause turned out to be a division of a negative number by an unsigned value. |
| You expect that -8 / 2U would be -4, but in reality it is 2147483644 :-( |
| |
| Fixes: 3e14e7a82c1ef ("vivid-tpg: add hor/vert downsampling support to tpg_gen_text") |
| |
| Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> |
| Reported-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Cc: <stable@vger.kernel.org> # for v4.1 and up |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c |
| +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c |
| @@ -1650,7 +1650,7 @@ typedef struct { u16 __; u8 _; } __packe |
| pos[7] = (chr & (0x01 << 0) ? fg : bg); \ |
| } \ |
| \ |
| - pos += (tpg->hflip ? -8 : 8) / hdiv; \ |
| + pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \ |
| } \ |
| } \ |
| } while (0) |
