This is an automatic generated email to let you know that the following patch were queued:

Subject: media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD Author: Hans Verkuil hverkuil@xs4all.nl Date: Mon Oct 8 15:08:27 2018 -0400

When the OSD is on (i.e. vivid displays text on top of the test pattern), and you enable hflip, then the driver crashes.

The cause turned out to be a division of a negative number by an unsigned value. You expect that -8 / 2U would be -4, but in reality it is 2147483644 :-(

Fixes: 3e14e7a82c1ef ("vivid-tpg: add hor/vert downsampling support to tpg_gen_text")

Signed-off-by: Hans Verkuil hans.verkuil@cisco.com Reported-by: Mauro Carvalho Chehab mchehab+samsung@kernel.org Cc: stable@vger.kernel.org # for v4.1 and up Signed-off-by: Mauro Carvalho Chehab mchehab+samsung@kernel.org

drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

---

diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c index 76b125ebee6d..fa483b95bc5a 100644 --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -1801,7 +1801,7 @@ typedef struct { u16 __; u8 _; } __packed x24; pos[7] = (chr & (0x01 << 0) ? fg : bg); \ } \ \ - pos += (tpg->hflip ? -8 : 8) / hdiv; \ + pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \ } \ } \ } while (0)