Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23ff6043 authored by Laurent Pinchart's avatar Laurent Pinchart Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (11945): uvcvideo: Don't accept to change the format when buffers are allocated. 



Setting a new frame format or size will likely change the buffer size required
to store a complete video frame. To avoid a buffer overflow, don't allow
VIDIOC_S_FMT calls when video buffers are already allocated.

Signed-off-by: default avatarLaurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent d732c44c

drivers/media/video/uvc/uvc_queue.c

+14 −0
Original line number Diff line number Diff line
@@ -172,6 +172,20 @@ int uvc_free_buffers(struct uvc_video_queue *queue) 
	return 0;

}



/*

 * Check if buffers have been allocated.

 */

int uvc_queue_allocated(struct uvc_video_queue *queue)

{

	int allocated;



	mutex_lock(&queue->mutex);

	allocated = queue->count != 0;

	mutex_unlock(&queue->mutex);



	return allocated;

}



static void __uvc_query_buffer(struct uvc_buffer *buf,

		struct v4l2_buffer *v4l2_buf)

{

drivers/media/video/uvc/uvc_v4l2.c

+1 −1
Original line number Diff line number Diff line
@@ -251,7 +251,7 @@ static int uvc_v4l2_set_format(struct uvc_video_device *video, 
	if (fmt->type != video->streaming->type)

		return -EINVAL;



	if (uvc_queue_streaming(&video->queue))

	if (uvc_queue_allocated(&video->queue))

		return -EBUSY;



	ret = uvc_v4l2_try_format(video, fmt, &probe, &format, &frame);

drivers/media/video/uvc/uvcvideo.h

+1 −0
Original line number Diff line number Diff line
@@ -747,6 +747,7 @@ extern struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue, 
		struct uvc_buffer *buf);

extern unsigned int uvc_queue_poll(struct uvc_video_queue *queue,

		struct file *file, poll_table *wait);

extern int uvc_queue_allocated(struct uvc_video_queue *queue);

static inline int uvc_queue_streaming(struct uvc_video_queue *queue)

{

	return queue->flags & UVC_QUEUE_STREAMING;