UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

media: atomisp: Check buffer index is in range inside atomisp_qbuf_wrapper() 

Check buffer index is in range inside atomisp_qbuf_wrapper() before
using it do index pipe->frame_request_config_id[].

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
This commit is contained in:
Hans de Goede 2022-12-28 20:31:43 +01:00 committed by Mauro Carvalho Chehab
parent 2e18e118c2
commit bcc5997250
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/staging/media/atomisp/pci/atomisp_ioctl.c
View File

@ -1067,13 +1067,23 @@ error:
return -ENOMEM; return -ENOMEM;
} }
/*
* FIXME the abuse of buf->reserved2 in the qbuf and dqbuf wrappers comes from
* the original atomisp buffer handling and should be replaced with proper V4L2
* per frame parameters use.
*
* Once this is fixed these wrappers can be removed, replacing them with direct
* calls to vb2_ioctl_[d]qbuf().
*/
static int atomisp_qbuf_wrapper(struct file *file, void *fh, struct v4l2_buffer *buf) static int atomisp_qbuf_wrapper(struct file *file, void *fh, struct v4l2_buffer *buf)
{ {
struct video_device *vdev = video_devdata(file); struct video_device *vdev = video_devdata(file);
struct atomisp_device *isp = video_get_drvdata(vdev); struct atomisp_device *isp = video_get_drvdata(vdev);
struct atomisp_video_pipe *pipe = atomisp_to_video_pipe(vdev); struct atomisp_video_pipe *pipe = atomisp_to_video_pipe(vdev);
/* FIXME this abuse of buf->reserved2 comes from the original atomisp buffer handling */ if (buf->index >= vdev->queue->num_buffers)
return -EINVAL;
if (!atomisp_is_vf_pipe(pipe) && if (!atomisp_is_vf_pipe(pipe) &&
(buf->reserved2 & ATOMISP_BUFFER_HAS_PER_FRAME_SETTING)) { (buf->reserved2 & ATOMISP_BUFFER_HAS_PER_FRAME_SETTING)) {
/* this buffer will have a per-frame parameter */ /* this buffer will have a per-frame parameter */
@ -1106,7 +1116,6 @@ static int atomisp_dqbuf_wrapper(struct file *file, void *fh, struct v4l2_buffer
vb = pipe->vb_queue.bufs[buf->index]; vb = pipe->vb_queue.bufs[buf->index];
frame = vb_to_frame(vb); frame = vb_to_frame(vb);
/* FIXME this abuse of buf->reserved* comes from the original atomisp buffer handling */
buf->reserved = asd->frame_status[buf->index]; buf->reserved = asd->frame_status[buf->index];
/* /*