diff options
Diffstat (limited to 'target/linux/brcm2708/patches-4.19/950-0274-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch')
| -rw-r--r-- | target/linux/brcm2708/patches-4.19/950-0274-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/target/linux/brcm2708/patches-4.19/950-0274-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch b/target/linux/brcm2708/patches-4.19/950-0274-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch new file mode 100644 index 0000000000..c4e78a1e21 --- /dev/null +++ b/target/linux/brcm2708/patches-4.19/950-0274-staging-bcm2835-camera-Add-sanity-checks-for-queue_s.patch @@ -0,0 +1,44 @@ +From 6b3fde1207785584dbd1fdf65110cf60bd29b409 Mon Sep 17 00:00:00 2001 +From: Dave Stevenson <dave.stevenson@raspberrypi.org> +Date: Tue, 15 Jan 2019 15:35:24 +0000 +Subject: [PATCH] staging: bcm2835-camera: Add sanity checks for + queue_setup/CREATE_BUFS + +Fixes a v4l2-compliance failure when passed a buffer that is +too small. +queue_setup wasn't handling the case where !(*nplanes), as +used from CREATE_BUFS and requiring the driver to sanity +check the provided buffer parameters. It was assuming that +it was always being used in the REQBUFS case where it provides +the buffer properties. + +Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org> +--- + .../bcm2835-camera/bcm2835-camera.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c ++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c +@@ -242,6 +242,22 @@ static int queue_setup(struct vb2_queue + return -EINVAL; + } + ++ /* Handle CREATE_BUFS situation - *nplanes != 0 */ ++ if (*nplanes) { ++ if (*nplanes != 1 || ++ sizes[0] < dev->capture.port->current_buffer.size) { ++ v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, ++ "%s: dev:%p Invalid buffer request from CREATE_BUFS, size %u < %u, nplanes %u != 1\n", ++ __func__, dev, sizes[0], ++ dev->capture.port->current_buffer.size, ++ *nplanes); ++ return -EINVAL; ++ } else { ++ return 0; ++ } ++ } ++ ++ /* Handle REQBUFS situation */ + size = dev->capture.port->current_buffer.size; + if (size == 0) { + v4l2_err(&dev->v4l2_dev, |