From patchwork Fri Sep 16 10:00:29 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Archit Taneja X-Patchwork-Id: 353 Return-path: Envelope-to: mchehab@canuck.infradead.org Delivery-date: Fri, 16 Sep 2011 09:59:16 +0000 Received: from canuck.infradead.org [134.117.69.58] by localhost.localdomain with IMAP (fetchmail-6.3.20) for (single-drop); Fri, 16 Sep 2011 07:56:05 -0300 (BRT) Received: from casper.infradead.org ([2001:770:15f::2]) by canuck.infradead.org with esmtps (Exim 4.76 #1 (Red Hat Linux)) id 1R4VCW-0005WN-Kv for mchehab@canuck.infradead.org; Fri, 16 Sep 2011 09:59:16 +0000 Received: from vger.kernel.org ([209.132.180.67]) by casper.infradead.org with esmtp (Exim 4.76 #1 (Red Hat Linux)) id 1R4VCT-0006sB-VI; Fri, 16 Sep 2011 09:59:15 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752372Ab1IPJ7I (ORCPT + 1 other); Fri, 16 Sep 2011 05:59:08 -0400 Received: from comal.ext.ti.com ([198.47.26.152]:45155 "EHLO comal.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752487Ab1IPJ7G (ORCPT ); Fri, 16 Sep 2011 05:59:06 -0400 Received: from dlep34.itg.ti.com ([157.170.170.115]) by comal.ext.ti.com (8.13.7/8.13.7) with ESMTP id p8G9x5jk004229 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 16 Sep 2011 04:59:05 -0500 Received: from dlep26.itg.ti.com (smtp-le.itg.ti.com [157.170.170.27]) by dlep34.itg.ti.com (8.13.7/8.13.8) with ESMTP id p8G9x56J017438; Fri, 16 Sep 2011 04:59:05 -0500 (CDT) Received: from DLEE74.ent.ti.com (localhost [127.0.0.1]) by dlep26.itg.ti.com (8.13.8/8.13.8) with ESMTP id p8G9x5o5022383; Fri, 16 Sep 2011 04:59:05 -0500 (CDT) Received: from dlelxv23.itg.ti.com (172.17.1.198) by DLEE74.ent.ti.com (157.170.170.8) with Microsoft SMTP Server id 14.1.323.3; Fri, 16 Sep 2011 04:59:05 -0500 Received: from legion.dal.design.ti.com (legion.dal.design.ti.com [128.247.22.53]) by dlelxv23.itg.ti.com (8.13.8/8.13.8) with ESMTP id p8G9x4NG022000; Fri, 16 Sep 2011 04:59:04 -0500 Received: from localhost (a0393947pc.apr.dhcp.ti.com [172.24.137.144]) by legion.dal.design.ti.com (8.11.7p1+Sun/8.11.7) with ESMTP id p8G9x2010526; Fri, 16 Sep 2011 04:59:02 -0500 (CDT) From: Archit Taneja To: CC: , , , , Archit Taneja Subject: [PATCH 1/5] [media]: OMAP_VOUT: Fix check in reqbuf & mmap for buf_size allocation Date: Fri, 16 Sep 2011 15:30:29 +0530 Message-ID: <1316167233-1437-2-git-send-email-archit@ti.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1316167233-1437-1-git-send-email-archit@ti.com> References: <1316167233-1437-1-git-send-email-archit@ti.com> MIME-Version: 1.0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20110916_105914_401658_8EEF91A8 X-CRM114-Status: GOOD ( 17.71 ) X-Spam-Score: -2.2 (--) X-Spam-Report: SpamAssassin version 3.3.2 on casper.infradead.org summary: Content analysis details: (-2.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at http://www.dnswl.org/, high trust [209.132.180.67 listed in list.dnswl.org] 2.8 KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB 2.5 TAB_IN_FROM From starts with a tab -0.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] The commit 383e4f69879d11c86ebdd38b3356f6d0690fb4cc makes reqbuf and mmap prevent requesting a larger size buffer than what is allocated at kernel boot during omap_vout_probe. The requested size is compared with vout->buffer_size, this isn't correct as vout->buffer_size is later set to the size requested in reqbuf. When the video device is opened the next time, this check will prevent us to allocate a buffer which is larger than what we requested the last time. Don't use vout->buffer_size, always check with the parameters video1_bufsize or video2_bufsize. Signed-off-by: Archit Taneja --- drivers/media/video/omap/omap_vout.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c index 95daf98..e14c82b 100644 --- a/drivers/media/video/omap/omap_vout.c +++ b/drivers/media/video/omap/omap_vout.c @@ -664,10 +664,14 @@ static int omap_vout_buffer_setup(struct videobuf_queue *q, unsigned int *count, u32 phy_addr = 0, virt_addr = 0; struct omap_vout_device *vout = q->priv_data; struct omapvideo_info *ovid = &vout->vid_info; + int vid_max_buf_size; if (!vout) return -EINVAL; + vid_max_buf_size = vout->vid == OMAP_VIDEO1 ? video1_bufsize : + video2_bufsize; + if (V4L2_BUF_TYPE_VIDEO_OUTPUT != q->type) return -EINVAL; @@ -690,7 +694,7 @@ static int omap_vout_buffer_setup(struct videobuf_queue *q, unsigned int *count, video1_numbuffers : video2_numbuffers; /* Check the size of the buffer */ - if (*size > vout->buffer_size) { + if (*size > vid_max_buf_size) { v4l2_err(&vout->vid_dev->v4l2_dev, "buffer allocation mismatch [%u] [%u]\n", *size, vout->buffer_size); @@ -865,6 +869,8 @@ static int omap_vout_mmap(struct file *file, struct vm_area_struct *vma) unsigned long size = (vma->vm_end - vma->vm_start); struct omap_vout_device *vout = file->private_data; struct videobuf_queue *q = &vout->vbq; + int vid_max_buf_size = vout->vid == OMAP_VIDEO1 ? video1_bufsize : + video2_bufsize; v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, " %s pgoff=0x%lx, start=0x%lx, end=0x%lx\n", __func__, @@ -887,7 +893,7 @@ static int omap_vout_mmap(struct file *file, struct vm_area_struct *vma) return -EINVAL; } /* Check the size of the buffer */ - if (size > vout->buffer_size) { + if (size > vid_max_buf_size) { v4l2_err(&vout->vid_dev->v4l2_dev, "insufficient memory [%lu] [%u]\n", size, vout->buffer_size);