Re: [PATCH] drm/tegra: Fix window[0] base address corruption

2016-08-24 Thread Thierry Reding
On Sun, Aug 21, 2016 at 11:57:58AM +0300, Dmitry Osipenko wrote: > Window uses shared stride for UV planes and tegra_dc_window struct > defines array of 2 strides per window. That's not taken in account > during setting up of the window addresses and strides, resulting in > out-of-bounds write of

Re: [PATCH] drm/tegra: Fix window[0] base address corruption

2016-08-24 Thread Thierry Reding
On Sun, Aug 21, 2016 at 11:57:58AM +0300, Dmitry Osipenko wrote: > Window uses shared stride for UV planes and tegra_dc_window struct > defines array of 2 strides per window. That's not taken in account > during setting up of the window addresses and strides, resulting in > out-of-bounds write of

[PATCH] drm/tegra: Fix window[0] base address corruption

2016-08-21 Thread Dmitry Osipenko
Window uses shared stride for UV planes and tegra_dc_window struct defines array of 2 strides per window. That's not taken in account during setting up of the window addresses and strides, resulting in out-of-bounds write of the 3-rd (non-existent) V plane stride that overwrites Y plane base

[PATCH] drm/tegra: Fix window[0] base address corruption

2016-08-21 Thread Dmitry Osipenko
Window uses shared stride for UV planes and tegra_dc_window struct defines array of 2 strides per window. That's not taken in account during setting up of the window addresses and strides, resulting in out-of-bounds write of the 3-rd (non-existent) V plane stride that overwrites Y plane base