The random_line buffer must be twice the maximum width, but it only allocated
the maximum width, so it was only half the size it needed to be.

Surprisingly I never saw the kernel fail on this, but the same TPG code used in
qv4l2 crashed and valgrind helped me track this bug down.

Signed-off-by: Hans Verkuil <hans.verk...@cisco.com>

diff --git a/drivers/media/platform/vivid/vivid-tpg.c 
b/drivers/media/platform/vivid/vivid-tpg.c
index 0c6fa53..cbcd625 100644
--- a/drivers/media/platform/vivid/vivid-tpg.c
+++ b/drivers/media/platform/vivid/vivid-tpg.c
@@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
                tpg->black_line[plane] = vzalloc(max_w * pixelsz);
                if (!tpg->black_line[plane])
                        return -ENOMEM;
-               tpg->random_line[plane] = vzalloc(max_w * pixelsz);
+               tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
                if (!tpg->random_line[plane])
                        return -ENOMEM;
        }
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to