Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c601f53f authored by Laurent Pinchart's avatar Laurent Pinchart Committed by Mauro Carvalho Chehab
Browse files

[media] v4l: uvcvideo: Fix buffer completion size check 



Commit e93e7fd9 ("v4l2: uvcvideo: Allow
using larger buffers") reworked the buffer size sanity check at buffer
completion time to use the frame size instead of the allocated buffer
size. However, it introduced two bugs in doing so:

- it assigned the allocated buffer size to the frame_size field, instead
  of assigning the correct frame size

- it performed the assignment in the S_FMT handler, resulting in the
  frame_size field being uninitialized if the userspace application
  doesn't call S_FMT.

Fix both issues by removing the frame_size field and validating the
buffer size against the UVC video control dwMaxFrameSize.

Fixes: e93e7fd9 ("v4l2: uvcvideo: Allow using larger buffers")

Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent c204e1fa

drivers/media/usb/uvc/uvc_v4l2.c

+0 −1
Original line number Original line Diff line number Diff line
@@ -318,7 +318,6 @@ static int uvc_v4l2_set_format(struct uvc_streaming *stream, 
	stream->ctrl = probe;

	stream->ctrl = probe;

	stream->cur_format = format;

	stream->cur_format = format;

	stream->cur_frame = frame;

	stream->cur_frame = frame;

	stream->frame_size = fmt->fmt.pix.sizeimage;





done:

done:

	mutex_unlock(&stream->mutex);

	mutex_unlock(&stream->mutex);

drivers/media/usb/uvc/uvc_video.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -1143,7 +1143,7 @@ static int uvc_video_encode_data(struct uvc_streaming *stream, 
static void uvc_video_validate_buffer(const struct uvc_streaming *stream,

static void uvc_video_validate_buffer(const struct uvc_streaming *stream,

				      struct uvc_buffer *buf)

				      struct uvc_buffer *buf)

{

{

	if (stream->frame_size != buf->bytesused &&

	if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&

	    !(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))

	    !(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))

		buf->error = 1;

		buf->error = 1;

}

}

drivers/media/usb/uvc/uvcvideo.h

+0 −1
Original line number Original line Diff line number Diff line
@@ -457,7 +457,6 @@ struct uvc_streaming { 
	struct uvc_format *def_format;

	struct uvc_format *def_format;

	struct uvc_format *cur_format;

	struct uvc_format *cur_format;

	struct uvc_frame *cur_frame;

	struct uvc_frame *cur_frame;

	size_t frame_size;





	/* Protect access to ctrl, cur_format, cur_frame and hardware video

	/* Protect access to ctrl, cur_format, cur_frame and hardware video

	 * probe control.

	 * probe control.