From 5095a6413a0cf896ab468009b6142cb0fe617e66 Mon Sep 17 00:00:00 2001
From: Xia Jiang <xia.jiang@mediatek.com>
Date: Fri, 14 Aug 2020 09:11:35 +0200
Subject: [PATCH] media: platform: Improve queue set up flow for bug fixing
Git-commit: 5095a6413a0cf896ab468009b6142cb0fe617e66
Patch-mainline: v5.10-rc1
References: git-fixes
Add checking created buffer size follow in mtk_jpeg_queue_setup().
Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Xia Jiang <xia.jiang@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index d1b13556e18b..93347ab9b953 100644
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -571,6 +571,13 @@ static int mtk_jpeg_queue_setup(struct vb2_queue *q,
if (!q_data)
return -EINVAL;
+ if (*num_planes) {
+ for (i = 0; i < *num_planes; i++)
+ if (sizes[i] < q_data->sizeimage[i])
+ return -EINVAL;
+ return 0;
+ }
+
*num_planes = q_data->fmt->colplanes;
for (i = 0; i < q_data->fmt->colplanes; i++) {
sizes[i] = q_data->sizeimage[i];
--
2.16.4