From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
To: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Cc: linux-media@vger.kernel.org
Subject: Re: [PATCH] v4l: uvcvideo: Fix buffer completion size check
Date: Thu, 02 Oct 2014 21:08:27 +0300 [thread overview]
Message-ID: <2530457.fbzKgqC21y@avalon> (raw)
In-Reply-To: <1412113371-11485-1-git-send-email-laurent.pinchart@ideasonboard.com>
Hi Guennadi,
Ping ?
On Wednesday 01 October 2014 00:42:51 Laurent Pinchart wrote:
> Commit e93e7fd9f5a3fffec7792dbcc4c3574653effda7 ("v4l2: uvcvideo: Allow
> using larger buffers") reworked the buffer size sanity check at buffer
> completion time to use the frame size instead of the allocated buffer
> size. However, it introduced two bugs in doing so:
>
> - it assigned the allocated buffer size to the frame_size field, instead
> of assigning the correct frame size
>
> - it performed the assignment in the S_FMT handler, resulting in the
> frame_size field being uninitialized if the userspace application
> doesn't call S_FMT.
>
> Fix both issues by removing the frame_size field and validating the
> buffer size against the UVC video control dwMaxFrameSize.
>
> Fixes: e93e7fd9f5a3 ("v4l2: uvcvideo: Allow using larger buffers")
> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> ---
> drivers/media/usb/uvc/uvc_v4l2.c | 1 -
> drivers/media/usb/uvc/uvc_video.c | 2 +-
> drivers/media/usb/uvc/uvcvideo.h | 1 -
> 3 files changed, 1 insertion(+), 3 deletions(-)
>
> Guennadi, could you please test and ack this ASAP, as the bug needs to be
> fixed for v3.18-rc1 if possible ?
>
> diff --git a/drivers/media/usb/uvc/uvc_v4l2.c
> b/drivers/media/usb/uvc/uvc_v4l2.c index f205934..f33a067 100644
> --- a/drivers/media/usb/uvc/uvc_v4l2.c
> +++ b/drivers/media/usb/uvc/uvc_v4l2.c
> @@ -318,7 +318,6 @@ static int uvc_v4l2_set_format(struct uvc_streaming
> *stream, stream->ctrl = probe;
> stream->cur_format = format;
> stream->cur_frame = frame;
> - stream->frame_size = fmt->fmt.pix.sizeimage;
>
> done:
> mutex_unlock(&stream->mutex);
> diff --git a/drivers/media/usb/uvc/uvc_video.c
> b/drivers/media/usb/uvc/uvc_video.c index 9ace520..df81b9c 100644
> --- a/drivers/media/usb/uvc/uvc_video.c
> +++ b/drivers/media/usb/uvc/uvc_video.c
> @@ -1143,7 +1143,7 @@ static int uvc_video_encode_data(struct uvc_streaming
> *stream, static void uvc_video_validate_buffer(const struct uvc_streaming
> *stream, struct uvc_buffer *buf)
> {
> - if (stream->frame_size != buf->bytesused &&
> + if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
> !(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))
> buf->error = 1;
> }
> diff --git a/drivers/media/usb/uvc/uvcvideo.h
> b/drivers/media/usb/uvc/uvcvideo.h index f585c08..897cfd8 100644
> --- a/drivers/media/usb/uvc/uvcvideo.h
> +++ b/drivers/media/usb/uvc/uvcvideo.h
> @@ -458,7 +458,6 @@ struct uvc_streaming {
> struct uvc_format *def_format;
> struct uvc_format *cur_format;
> struct uvc_frame *cur_frame;
> - size_t frame_size;
>
> /* Protect access to ctrl, cur_format, cur_frame and hardware video
> * probe control.
--
Regards,
Laurent Pinchart
next prev parent reply other threads:[~2014-10-02 18:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-09-30 21:42 [PATCH] v4l: uvcvideo: Fix buffer completion size check Laurent Pinchart
2014-09-30 22:00 ` Laurent Pinchart
2014-10-02 18:08 ` Laurent Pinchart [this message]
2014-11-07 22:49 ` Guennadi Liakhovetski
2014-11-10 15:18 ` Guennadi Liakhovetski
2014-11-10 21:15 ` Guennadi Liakhovetski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2530457.fbzKgqC21y@avalon \
--to=laurent.pinchart@ideasonboard.com \
--cc=g.liakhovetski@gmx.de \
--cc=linux-media@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).