On 16/10/2024 12:22, Mauro Carvalho Chehab wrote:

The logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever

scaled_witdh -> scaled_width

happens, this will cause a division by zero.

Instead, add a WARN_ON() to trigger such cases and return without doing any precalculation.

Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator") Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab mchehab+huawei@kernel.org

---

drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c index c86343a4d0bf..a22f31515d7e 100644 --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -1795,6 +1795,9 @@ static void tpg_precalculate_line(struct tpg_data *tpg) unsigned p; unsigned x;

• if (WARN_ON(tpg->src_width == 0))

You need to check for both src_width and scaled_width.

Also replace this by WARN_ON_ONCE.

Regards,

Hans

• return;
  

• switch (tpg->pattern) { case TPG_PAT_GREEN: contrast = TPG_COLOR_100_RED;