From dfa6f2400c1f0bb2183996ac1c74f1fc859fca32 Mon Sep 17 00:00:00 2001 From: Guennadi Liakhovetski Date: Tue, 8 Aug 2017 08:56:22 -0400 Subject: [PATCH] media: uvcvideo: Fix .queue_setup() to check the number of planes According to documentation of struct vb2_ops the .queue_setup() callback should return an error if the number of planes parameter contains an invalid value on input. Fix this instead of ignoring the value. Signed-off-by: Guennadi Liakhovetski Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/uvc/uvc_queue.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c index aa21997..c8d78b2 100644 --- a/drivers/media/usb/uvc/uvc_queue.c +++ b/drivers/media/usb/uvc/uvc_queue.c @@ -82,9 +82,14 @@ static int uvc_queue_setup(struct vb2_queue *vq, struct uvc_streaming *stream = uvc_queue_to_stream(queue); unsigned size = stream->ctrl.dwMaxVideoFrameSize; - /* Make sure the image size is large enough. */ + /* + * When called with plane sizes, validate them. The driver supports + * single planar formats only, and requires buffers to be large enough + * to store a complete frame. + */ if (*nplanes) - return sizes[0] < size ? -EINVAL : 0; + return *nplanes != 1 || sizes[0] < size ? -EINVAL : 0; + *nplanes = 1; sizes[0] = size; return 0; -- 2.7.4