[3/3] vb2: prevent drivers from requesting too many buffers/planes.

Message ID 1301873937-14146-3-git-send-email-pawel@osciak.com (mailing list archive)
State Changes Requested, archived
Headers

Commit Message

Pawel Osciak April 3, 2011, 11:38 p.m. UTC
  Add a sanity check to make sure drivers do not adjust the number of buffers
or planes above the supported limit on reqbufs.

Signed-off-by: Pawel Osciak <pawel@osciak.com>
---
 drivers/media/video/videobuf2-core.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)
  

Comments

Hans Verkuil April 4, 2011, 6:24 a.m. UTC | #1
On Monday, April 04, 2011 01:38:57 Pawel Osciak wrote:
> Add a sanity check to make sure drivers do not adjust the number of buffers
> or planes above the supported limit on reqbufs.
> 
> Signed-off-by: Pawel Osciak <pawel@osciak.com>
> ---
>  drivers/media/video/videobuf2-core.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
> index 6698c77..6e69584 100644
> --- a/drivers/media/video/videobuf2-core.c
> +++ b/drivers/media/video/videobuf2-core.c
> @@ -529,6 +529,11 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
>  	if (ret)
>  		return ret;
>  
> +	/*
> +	 * Make sure driver did not request more buffers/planes than we can handle.
> +	 */
> +	BUG_ON (num_buffers > VIDEO_MAX_FRAME || num_planes > VIDEO_MAX_PLANES);
> +

I would make this a 'if' with a WARN_ON and error return. More debug-friendly.

Regards,

	Hans

>  	/* Finally, allocate buffers and video memory */
>  	ret = __vb2_queue_alloc(q, req->memory, num_buffers, num_planes,
>  				plane_sizes);
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
  

Patch

diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 6698c77..6e69584 100644
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -529,6 +529,11 @@  int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
 	if (ret)
 		return ret;
 
+	/*
+	 * Make sure driver did not request more buffers/planes than we can handle.
+	 */
+	BUG_ON (num_buffers > VIDEO_MAX_FRAME || num_planes > VIDEO_MAX_PLANES);
+
 	/* Finally, allocate buffers and video memory */
 	ret = __vb2_queue_alloc(q, req->memory, num_buffers, num_planes,
 				plane_sizes);