diff mbox

[v2] omap3isp: queue: fail QBUF if user buffer is too small

Message ID 1312872140-7517-1-git-send-email-michael.jones@matrix-vision.de (mailing list archive)
State Accepted, archived
Headers

Commit Message

Michael Jones Aug. 9, 2011, 6:42 a.m. UTC 
  Add buffer length check to sanity checks for USERPTR QBUF

Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>
---
Changes for v2:
 - only check when V4L2_MEMORY_USERPTR

 drivers/media/video/omap3isp/ispqueue.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

Comments

Laurent Pinchart Aug. 9, 2011, 7:42 a.m. UTC | #1 
Hi Michael,

On Tuesday 09 August 2011 08:42:20 Michael Jones wrote:
> Add buffer length check to sanity checks for USERPTR QBUF
> 
> Signed-off-by: Michael Jones <michael.jones@matrix-vision.de>

Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

I'll push the patch to v3.2.

> ---
> Changes for v2:
>  - only check when V4L2_MEMORY_USERPTR
> 
>  drivers/media/video/omap3isp/ispqueue.c |    4 ++++
>  1 files changed, 4 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/media/video/omap3isp/ispqueue.c
> b/drivers/media/video/omap3isp/ispqueue.c index 9c31714..9bebb1e 100644
> --- a/drivers/media/video/omap3isp/ispqueue.c
> +++ b/drivers/media/video/omap3isp/ispqueue.c
> @@ -868,6 +868,10 @@ int omap3isp_video_queue_qbuf(struct isp_video_queue
> *queue, goto done;
> 
>  	if (vbuf->memory == V4L2_MEMORY_USERPTR &&
> +	    vbuf->length < buf->vbuf.length)
> +		goto done;
> +
> +	if (vbuf->memory == V4L2_MEMORY_USERPTR &&
>  	    vbuf->m.userptr != buf->vbuf.m.userptr) {
>  		isp_video_buffer_cleanup(buf);
>  		buf->vbuf.m.userptr = vbuf->m.userptr;
diff mbox

Patch

diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c
index 9c31714..9bebb1e 100644
--- a/drivers/media/video/omap3isp/ispqueue.c
+++ b/drivers/media/video/omap3isp/ispqueue.c
@@ -868,6 +868,10 @@  int omap3isp_video_queue_qbuf(struct isp_video_queue *queue,
 		goto done;
 
 	if (vbuf->memory == V4L2_MEMORY_USERPTR &&
+	    vbuf->length < buf->vbuf.length)
+		goto done;
+
+	if (vbuf->memory == V4L2_MEMORY_USERPTR &&
 	    vbuf->m.userptr != buf->vbuf.m.userptr) {
 		isp_video_buffer_cleanup(buf);
 		buf->vbuf.m.userptr = vbuf->m.userptr;