drm: xlnx: scaler: Fix array out of bound access

This patch fixes random kernel crashes observed due to accessing and
modifying the out of bound address of the vertical scaler coefficients
array.

Signed-off-by: Vishal Sagar <vishal.sagar@xilinx.com>
Reviewed-by: Hyun Kwon <hyun.kwon@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>

diff --git a/drivers/gpu/drm/xlnx/xlnx_scaler.c b/drivers/gpu/drm/xlnx/xlnx_scaler.c
index d96ddeb49b5972072a3f8c833285ca70a64d0f81..0c13d3cd572803d4da212047517a7d4598d291db 100644 (file)
--- a/drivers/gpu/drm/xlnx/xlnx_scaler.c
+++ b/drivers/gpu/drm/xlnx/xlnx_scaler.c
@@ -1059,10 +1059,11 @@ xv_vscaler_load_ext_coeff(struct xilinx_scaler *scaler,
                        /* pad left */
                        for (j = 0; j < offset; j++)
                                scaler->vscaler_coeff[i][j] = 0;
+                       /* pad right */
+                       j = ntaps + offset;
+                       for (; j < XV_VSCALER_MAX_V_TAPS; j++)
+                               scaler->vscaler_coeff[i][j] = 0;
                }
-               /* pad right */
-               for (j = (ntaps + offset); j < XV_VSCALER_MAX_V_TAPS; j++)
-                       scaler->vscaler_coeff[i][j] = 0;
        }
 }