From patchwork Tue Sep 11 14:46:04 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Fjeldtvedt X-Patchwork-Id: 10595767 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1658114BD for ; Tue, 11 Sep 2018 14:45:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 051EA296DF for ; Tue, 11 Sep 2018 14:45:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EC6C4296E2; Tue, 11 Sep 2018 14:45:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8D29C296DF for ; Tue, 11 Sep 2018 14:45:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727647AbeIKToj (ORCPT ); Tue, 11 Sep 2018 15:44:39 -0400 Received: from aer-iport-3.cisco.com ([173.38.203.53]:49995 "EHLO aer-iport-3.cisco.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727642AbeIKToj (ORCPT ); Tue, 11 Sep 2018 15:44:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1531; q=dns/txt; s=iport; t=1536677101; x=1537886701; h=from:to:cc:subject:date:message-id; bh=nRrhFtcGO2yQ5WevsvTq51KinECJSytV284qbSHb5xs=; b=eAWWXqimLWHgHVKrdOsdARyqtYWuHTdhETd71EbA0RiZeA0kt362M2tV X1kc7JmI8JlkkaTKWhuIZZAL+d8hpeNb35YS4EJ2Ay8i+MdUb0WA9Yrt6 8ElsXWE+Qkq/jTohzyx5NaJ3JG3KbLw/Aa4Ux6tajxxlMmB8nHj97xQi+ 8=; X-IronPort-AV: E=Sophos;i="5.53,360,1531785600"; d="scan'208";a="6431217" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Sep 2018 14:45:00 +0000 Received: from jf-desktop.rd.cisco.com ([10.47.77.121]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTP id w8BEixUN006958; Tue, 11 Sep 2018 14:45:00 GMT From: Johan Fjeldtvedt To: linux-media@vger.kernel.org Cc: hansverk@cisco.com, Johan Fjeldtvedt Subject: [PATCH v4] vb2: check for sane values from queue_setup Date: Tue, 11 Sep 2018 16:46:04 +0200 Message-Id: <20180911144604.32616-1-johfjeld@cisco.com> X-Mailer: git-send-email 2.17.1 X-Outbound-SMTP-Client: 10.47.77.121, [10.47.77.121] X-Outbound-Node: aer-core-4.cisco.com Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Warn and return error from the reqbufs ioctl when driver sets 0 number of planes or 0 as plane sizes, as these values don't make any sense. Checking this here stops obviously wrong values from propagating further and causing various problems that are hard to trace back to either of these values being 0. v4: check num_planes, not num_buffers Signed-off-by: Johan Fjeldtvedt Acked-by: Sakari Ailus --- drivers/media/common/videobuf2/videobuf2-core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c index f32ec7342ef0..cf2f93462a54 100644 --- a/drivers/media/common/videobuf2/videobuf2-core.c +++ b/drivers/media/common/videobuf2/videobuf2-core.c @@ -662,6 +662,7 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, unsigned int num_buffers, allocated_buffers, num_planes = 0; unsigned plane_sizes[VB2_MAX_PLANES] = { }; int ret; + int i; if (q->streaming) { dprintk(1, "streaming active\n"); @@ -718,6 +719,14 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, if (ret) return ret; + /* Check that driver has set sane values */ + if (WARN_ON(!num_planes)) + return -EINVAL; + + for (i = 0; i < num_planes; i++) + if (WARN_ON(!plane_sizes[i])) + return -EINVAL; + /* Finally, allocate buffers and video memory */ allocated_buffers = __vb2_queue_alloc(q, memory, num_buffers, num_planes, plane_sizes);