X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=target%2Flinux%2Fbrcm2708%2Fpatches-4.19%2F950-0286-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch;fp=target%2Flinux%2Fbrcm2708%2Fpatches-4.19%2F950-0286-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch;h=c4e78a1e21b13d2d301e853d39ad45aed460f52d;hb=67dcc43f3a22dc3a7ac07a7065971b426feeb043;hp=0000000000000000000000000000000000000000;hpb=47a93a810f78adce5a130d287f82b28e9b54313c;p=openwrt%2Fopenwrt.git

diff --git a/target/linux/brcm2708/patches-4.19/950-0286-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch b/target/linux/brcm2708/patches-4.19/950-0286-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch
new file mode 100644
index 0000000000..c4e78a1e21
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.19/950-0286-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch
@@ -0,0 +1,44 @@
+From 6b3fde1207785584dbd1fdf65110cf60bd29b409 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.org>
+Date: Tue, 15 Jan 2019 15:35:24 +0000
+Subject: [PATCH] staging: bcm2835-camera: Add sanity checks for
+ queue_setup/CREATE_BUFS
+
+Fixes a v4l2-compliance failure when passed a buffer that is
+too small.
+queue_setup wasn't handling the case where !(*nplanes), as
+used from CREATE_BUFS and requiring the driver to sanity
+check the provided buffer parameters. It was assuming that
+it was always being used in the REQBUFS case where it provides
+the buffer properties.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
+---
+ .../bcm2835-camera/bcm2835-camera.c              | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -242,6 +242,22 @@ static int queue_setup(struct vb2_queue
+ 		return -EINVAL;
+ 	}
+ 
++	/* Handle CREATE_BUFS situation - *nplanes != 0 */
++	if (*nplanes) {
++		if (*nplanes != 1 ||
++		    sizes[0] < dev->capture.port->current_buffer.size) {
++			v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
++				 "%s: dev:%p Invalid buffer request from CREATE_BUFS, size %u < %u, nplanes %u != 1\n",
++				 __func__, dev, sizes[0],
++				 dev->capture.port->current_buffer.size,
++				 *nplanes);
++			return -EINVAL;
++		} else {
++			return 0;
++		}
++	}
++
++	/* Handle REQBUFS situation */
+ 	size = dev->capture.port->current_buffer.size;
+ 	if (size == 0) {
+ 		v4l2_err(&dev->v4l2_dev,