From 6f030562329e443e20fb844937e41ba5fbe767ff Mon Sep 17 00:00:00 2001 From: Vikash Garodia Date: Fri, 17 Mar 2017 12:55:51 +0530 Subject: [PATCH] msm: media: Allocate extra memory after alignment Existing memory allocation considers alignment after adding the extra lines needed by hardware. This does not increase the buffer size by the required size increment. Add the increment after aligning the scanlines to prevent out-of-bounds access. Change-Id: I5f6ff7cec99e4cb5f94edda506bd1740b9b38242 Signed-off-by: Vikash Garodia --- include/uapi/media/msm_media_info.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/include/uapi/media/msm_media_info.h b/include/uapi/media/msm_media_info.h index f59f034a72b9..13bee7a56a0e 100644 --- a/include/uapi/media/msm_media_info.h +++ b/include/uapi/media/msm_media_info.h @@ -222,7 +222,7 @@ enum color_fmts { * Y_Stride = align(Width, 128) * UV_Stride = align(Width, 128) * Y_Scanlines = align(Height, 32) - * UV_Scanlines = align((Height + 96)/2, 16) + * UV_Scanlines = align(Height/2, 16) * Y_UBWC_Plane_size = align(Y_Stride * Y_Scanlines, 4096) * UV_UBWC_Plane_size = align(UV_Stride * UV_Scanlines, 4096) * Y_Meta_Stride = align(roundup(Width, Y_TileWidth), 64) @@ -235,7 +235,7 @@ enum color_fmts { * * Total size = align( Y_UBWC_Plane_size + UV_UBWC_Plane_size + * Y_Meta_Plane_size + UV_Meta_Plane_size - * + Extradata), 4096) + * + max(Extradata, Y_Stride * 64), 4096) */ COLOR_FMT_NV12_UBWC, /* Venus NV12 10-bit UBWC: @@ -311,7 +311,7 @@ enum color_fmts { * Y_Stride = align(Width * 4/3, 128) * UV_Stride = align(Width * 4/3, 128) * Y_Scanlines = align(Height, 32) - * UV_Scanlines = align((Height + 96)/2, 16) + * UV_Scanlines = align(Height/2, 16) * Y_UBWC_Plane_Size = align(Y_Stride * Y_Scanlines, 4096) * UV_UBWC_Plane_Size = align(UV_Stride * UV_Scanlines, 4096) * Y_Meta_Stride = align(roundup(Width, Y_TileWidth), 64) @@ -324,7 +324,7 @@ enum color_fmts { * * Total size = align(Y_UBWC_Plane_size + UV_UBWC_Plane_size + * Y_Meta_Plane_size + UV_Meta_Plane_size - * + Extradata), 4096) + * + max(Extradata, Y_Stride * 64), 4096) */ COLOR_FMT_NV12_BPP10_UBWC, /* Venus RGBA8888 format: @@ -970,7 +970,6 @@ static inline unsigned int VENUS_BUFFER_SIZE( break; case COLOR_FMT_NV12_UBWC: case COLOR_FMT_NV12_BPP10_UBWC: - uv_sclines = VENUS_UV_SCANLINES(color_fmt, height + 96); y_ubwc_plane = MSM_MEDIA_ALIGN(y_stride * y_sclines, 4096); uv_ubwc_plane = MSM_MEDIA_ALIGN(uv_stride * uv_sclines, 4096); y_meta_stride = VENUS_Y_META_STRIDE(color_fmt, width); @@ -983,7 +982,8 @@ static inline unsigned int VENUS_BUFFER_SIZE( uv_meta_scanlines, 4096); size = y_ubwc_plane + uv_ubwc_plane + y_meta_plane + - uv_meta_plane + extra_size; + uv_meta_plane + MSM_MEDIA_MAX(extra_size, + 64 * y_stride); size = MSM_MEDIA_ALIGN(size, 4096); break; case COLOR_FMT_P010_UBWC: