upstream: [media] vb2: fix num_buffers calculation if req->count > VIDEO_MAX_FRAMES

num_buffers can't be bigger than VIDEO_MAX_FRAME. This is assured by:
  num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);

However, this value is overriden by:
  num_buffers = max_t(unsigned int, req->count, q->min_buffers_needed);

It should, instead, use the previously calculated value as an input
to max_t:
  num_buffers = max_t(unsigned int, num_buffers, q->min_buffers_needed);

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 8d37e29..6489c99 100644 (file)
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -905,7 +905,7 @@ static int __reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
         * Make sure the requested values and current defaults are sane.
         */
        num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);
-       num_buffers = max_t(unsigned int, req->count, q->min_buffers_needed);
+       num_buffers = max_t(unsigned int, num_buffers, q->min_buffers_needed);
        memset(q->plane_sizes, 0, sizeof(q->plane_sizes));
        memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
        q->memory = req->memory;