From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA61735972 for ; Wed, 10 Jun 2026 12:57:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781096250; cv=none; b=rAvHC0ER7PVAZSal1SPvnoZNWQPWNRkzAm95Gco+sKA0MW8naZ2/oeHSkRpEkK1XPrRjVkyI6+cxbguX3l8iFbYfM4ezFSOozG10V/L7C/LiEK+HN8nBSCcWPAln4XovxzRxzUooiZCaC2mE7Kr+ZVXj34O3Ior8Uf/8PHf20sg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781096250; c=relaxed/simple; bh=KpIx1agiZkgrFurtoJ1ET+tTDHaal1A3VQITZbFLKeA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r7kMJdaBZwZQ2powoCZsh5d1g2azc4T7IGNsBp/TBcpn2rUCy0bLqgYshUmUzQD6/DbkrwgM2dCPAHrmO0OJMNV/7oQsAzyBmqaKHuE/nOJR6MfnVwqVMP0Hv5qFTBiAIbajRzQ+S5AmsjujzZ/GOmsZ9+jlWLlV0QwgjnoWy+0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bnXgkwJE; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bnXgkwJE" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-490b64c8311so74439145e9.3 for ; Wed, 10 Jun 2026 05:57:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781096247; x=1781701047; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=t0d+zdeqH6lMcQH9MYJ6TD+dtSYgdC4zwQaodD6IKOc=; b=bnXgkwJECRpyxDxO3mR9D+1ghNsmeNjn4PGD/neqzOOPe7wWMGoVmU/tV9rYTN/yH5 0NIRir8Am/LKag4JfMBXCIUNMzKkd3sZPX8fzKgyF/XCcy7oSO7rnFLzTZgIh4Hnq7rW W83cBP1C1uiMB55m/4dyh+VwZ5CAwYAMRWIccPMwmVH5zhAH/fB7tHEjNqk7nh5oEXEV 21/q/vcSMpr0+6y4w20pvowwbUiIZAmUnn9C9m6NOc5UdLQACjvZmvR+U+70WeM3IFBc WZGVZHHIM7kMcH7/u0R0EiEK/4MXTm6mU+ec+dnfO5XbRo2/OkhDqBRAlRz+o5YaYDcd x4iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781096247; x=1781701047; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=t0d+zdeqH6lMcQH9MYJ6TD+dtSYgdC4zwQaodD6IKOc=; b=nrgGc7XaOzugzLwyxL36IVJfC8FmH4XzqFblhMguLWNjreKSGmf2iy7N7YPNq54ivJ fTYomo7fyjMrgctVfbzJWOlGkXIisfCVK7kh/3HBJxLWq8tlrSY2ZZanNS0Q6m11qXQh Jbscjn0K7pTYGOwB9BIl+khl/tHoUA6QVgMfRazU/12qMg0nLTfHZ8aMRcEtj8M/W+Ur g+cxpkNImKId0QiGs3SiTrQMIUBJ9+bvO7Zh/e0tzPEgabESN42Jg24m3SUiz7XHvBeD fUohaWbpT2brsWcK2dC1TXBFgWOErnme2ogpWNCArrNa03Y1i3VFaEF6ZcvSsU0jrp7t KMtw== X-Forwarded-Encrypted: i=1; AFNElJ+r3GxKvfkQ1xQ8c1qfGOtFSgfpGs/Ot5KYaAjluhs/7S0wBlD6LzPEPUCyZ7k2kZ2yUdnOqimb7Sp70eE=@vger.kernel.org X-Gm-Message-State: AOJu0YxIxmAThg7C6EF5Dk0+gJEVocszIcthQN6yzjQbsWpLHdrmxxSd hMG24IFKeGPH1RlE3sjuCYlrdmtr/0b5QuNwEyIugnsuxkuTqnk20Ic= X-Gm-Gg: Acq92OH5C3BbIbxWSuGxo75c9bDtU7k/ZIDl/bPAblsOw5eGG51Yka7iup5Af6oUapS 1KsSYuM+6vUBiKbKWPTT3P98QcLFX1PBRPChvaYgydyaSiDu9G4ROmwA2Db9mbDYqz0+tunDtne 1mMfC57R63BviuQuDNqyYDyWfq6r1/eWqDlX9a4Tvw3kJ0YVa3Yhc/+aJuMYdv7iNPAPTQAqvB7 ccBU3dLMcCTu0dOAKf73wNutHvAp6a6GLACj+t97FWtxzIn6fStr5VFzU6jMT3K4tEYqPmNgdP/ 9OheTvo6AeUm0MDdhp9Z3D2D7Y9ySTbmmG9ss5zg+y0SnPNyM9c6Ig8RBM2imdK1rgGma8s0EPs n4Fx6eqNYcEQ+QDs7Az509cz2mfskML4idoi+Hg6vgQupAFiNxo1w2xr9WtDZ4gT9FQwHL40a6+ 2ChVrJgR/WVtEmM/BorNV1WFeI7a3Ctk+hRHSK7i83uoMcd+SMSNCW+gcbUQcnk/Qrl0g+usl1V 2Nfmty0HTB+PgYSHW1XagZFJ+4IcLCNyrUS0FGX+RgXDAI3GyCslB4QpedUQrdz7A== X-Received: by 2002:a05:600c:6384:b0:490:acb8:1490 with SMTP id 5b1f17b1804b1-490c2591e5cmr378024635e9.4.1781096247246; Wed, 10 Jun 2026 05:57:27 -0700 (PDT) Received: from localhost.localdomain ([196.119.91.132]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-490bc3d66c8sm537328905e9.10.2026.06.10.05.57.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2026 05:57:26 -0700 (PDT) From: Mohammed EL Kadiri To: quic_vgarodia@quicinc.com, quic_dikshita@quicinc.com, bryan.odonoghue@linaro.org, mchehab@kernel.org Cc: hverkuil@kernel.org, dmitry.baryshkov@oss.qualcomm.com, linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Mohammed EL Kadiri , stable@vger.kernel.org Subject: [PATCH 2/2] media: venus: fix payload size calculation in parse_raw_formats() Date: Wed, 10 Jun 2026 13:56:55 +0100 Message-ID: <20260610125655.10517-3-med08elkadiri@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260610125655.10517-1-med08elkadiri@gmail.com> References: <20260610125655.10517-1-med08elkadiri@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The consumed size is computed after the loop using the num_planes value from the last iteration for all entries. When entries have different plane counts, this produces an incorrect total. Accumulate the actual size during the loop instead. Fixes: 9edaaa8e3e15 ("media: venus: hfi_parser: refactor hfi packet parsing logic") Cc: stable@vger.kernel.org Signed-off-by: Mohammed EL Kadiri --- drivers/media/platform/qcom/venus/hfi_parser.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c index e2af4e9901ee..522bac7ba154 100644 --- a/drivers/media/platform/qcom/venus/hfi_parser.c +++ b/drivers/media/platform/qcom/venus/hfi_parser.c @@ -171,7 +171,7 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) u32 entries = fmt->format_entries; unsigned int i = 0; u32 num_planes = 0; - u32 size; + u32 size = 2 * sizeof(u32); while (entries) { num_planes = pinfo->num_planes; @@ -186,6 +186,7 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) if (pinfo->num_planes > MAX_PLANES) break; + size += sizeof(*constr) * num_planes + 2 * sizeof(u32); pinfo = (void *)pinfo + sizeof(*constr) * num_planes + 2 * sizeof(u32); entries--; @@ -193,8 +194,6 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data) for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain, fill_raw_fmts, rawfmts, i); - size = fmt->format_entries * (sizeof(*constr) * num_planes + 2 * sizeof(u32)) - + 2 * sizeof(u32); return size; } -- 2.43.0