From 8ee92410e5bf29b7a2fcaf53ca241554c4bae7a9 Mon Sep 17 00:00:00 2001 From: Johan Fjeldtvedt Date: Mon, 17 Sep 2018 04:36:47 -0400 Subject: [PATCH] media: vb2: check for sane values from queue_setup Warn and return error from the reqbufs ioctl when driver sets 0 number of planes or 0 as plane sizes, as these values don't make any sense. Checking this here stops obviously wrong values from propagating further and causing various problems that are hard to trace back to either of these values being 0. Signed-off-by: Johan Fjeldtvedt Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/common/videobuf2/videobuf2-core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c index 5653e8eebe2b..d6d22cf77066 100644 --- a/drivers/media/common/videobuf2/videobuf2-core.c +++ b/drivers/media/common/videobuf2/videobuf2-core.c @@ -661,6 +661,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, { unsigned int num_buffers, allocated_buffers, num_planes = 0; unsigned plane_sizes[VB2_MAX_PLANES] = { }; + unsigned int i; int ret; if (q->streaming) { @@ -718,6 +719,14 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, if (ret) return ret; + /* Check that driver has set sane values */ + if (WARN_ON(!num_planes)) + return -EINVAL; + + for (i = 0; i < num_planes; i++) + if (WARN_ON(!plane_sizes[i])) + return -EINVAL; + /* Finally, allocate buffers and video memory */ allocated_buffers = __vb2_queue_alloc(q, memory, num_buffers, num_planes, plane_sizes); -- 2.45.2