target/linux/brcm2708/patches-4.19/950-0320-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch

   1 From cd78829bc64d03ae095636e1c5ed851e9fd7abf2 Mon Sep 17 00:00:00 2001
   2 From: Dave Stevenson <dave.stevenson@raspberrypi.org>
   3 Date: Tue, 15 Jan 2019 15:35:24 +0000
   4 Subject: [PATCH 320/703] staging: bcm2835-camera: Add sanity checks for
   5  queue_setup/CREATE_BUFS
   6
   7 Fixes a v4l2-compliance failure when passed a buffer that is
   8 too small.
   9 queue_setup wasn't handling the case where !(*nplanes), as
  10 used from CREATE_BUFS and requiring the driver to sanity
  11 check the provided buffer parameters. It was assuming that
  12 it was always being used in the REQBUFS case where it provides
  13 the buffer properties.
  14
  15 Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  16 ---
  17  .../bcm2835-camera/bcm2835-camera.c              | 16 ++++++++++++++++
  18  1 file changed, 16 insertions(+)
  19
  20 --- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
  21 +++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
  22 @@ -242,6 +242,22 @@ static int queue_setup(struct vb2_queue
  23                 return -EINVAL;
  24         }
  25
  26 +       /* Handle CREATE_BUFS situation - *nplanes != 0 */
  27 +       if (*nplanes) {
  28 +               if (*nplanes != 1 ||
  29 +                   sizes[0] < dev->capture.port->current_buffer.size) {
  30 +                       v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev,
  31 +                                "%s: dev:%p Invalid buffer request from CREATE_BUFS, size %u < %u, nplanes %u != 1\n",
  32 +                                __func__, dev, sizes[0],
  33 +                                dev->capture.port->current_buffer.size,
  34 +                                *nplanes);
  35 +                       return -EINVAL;
  36 +               } else {
  37 +                       return 0;
  38 +               }
  39 +       }
  40 +
  41 +       /* Handle REQBUFS situation */
  42         size = dev->capture.port->current_buffer.size;
  43         if (size == 0) {
  44                 v4l2_err(&dev->v4l2_dev,