On Wed Jun 10 13:56:55 2026 +0100, Mohammed EL Kadiri wrote:
> The consumed size is computed after the loop using the num_planes value
> from the last iteration for all entries. When entries have different
> plane counts, this produces an incorrect total.
> 
> Accumulate the actual size during the loop instead.
> 
> Fixes: 9edaaa8e3e15 ("media: venus: hfi_parser: refactor hfi packet parsing 
> logic")
> Cc: [email protected]
> Signed-off-by: Mohammed EL Kadiri <[email protected]>
> Reviewed-by: Dmitry Baryshkov <[email protected]>
> Signed-off-by: Bryan O'Donoghue <[email protected]>

Patch committed.

Thanks,
Bryan O'Donoghue

 drivers/media/platform/qcom/venus/hfi_parser.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

---

diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c 
b/drivers/media/platform/qcom/venus/hfi_parser.c
index 8284fcc78bb1..d07845f37c55 100644
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -171,7 +171,7 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 
domain, void *data)
        u32 entries = fmt->format_entries;
        unsigned int i = 0;
        u32 num_planes = 0;
-       u32 size;
+       u32 size = 2 * sizeof(u32);
 
        while (entries) {
                num_planes = pinfo->num_planes;
@@ -186,6 +186,7 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 
domain, void *data)
                if (pinfo->num_planes > MAX_PLANES)
                        break;
 
+               size += sizeof(*constr) * num_planes + 2 * sizeof(u32);
                pinfo = (void *)pinfo + sizeof(*constr) * num_planes +
                        2 * sizeof(u32);
                entries--;
@@ -193,8 +194,6 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 
domain, void *data)
 
        for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
                       fill_raw_fmts, rawfmts, i);
-       size = fmt->format_entries * (sizeof(*constr) * num_planes + 2 * 
sizeof(u32))
-               + 2 * sizeof(u32);
 
        return size;
 }
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to