[PATCH 0/3] media: uvcvideo: Fix allocation for small frame sizes

[PATCH 0/3] media: uvcvideo: Fix allocation for small frame sizes

[Ricardo Ribalda]

This set fixes a bug in uvc_alloc_urb_buffers() and two more style
patches.

The first patch was Reported by Itay, who asked if I could prepare and
send the patch on his behalf.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
Ricardo Ribalda (3):
      media: uvcvideo: Fix allocation for small frame sizes
      media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer
      media: uvcvideo: use min() for npacket calculation

 drivers/media/usb/uvc/uvc_video.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)
---
base-commit: 17526c7e69d07395e9d39794aacba42dcb02ff49
change-id: 20260114-uvc-alloc-urb-d1a0c617106a

Best regards,
-- 
Ricardo Ribalda <ribalda@chromium.org>

[PATCH 1/3] media: uvcvideo: Fix allocation for small frame sizes

[Ricardo Ribalda]

If a frame has size of less or equal than one packet size
uvc_alloc_urb_buffers() is unable to allocate memory for it due to a
off-by-one error.

Fix the off-by-one-error and now that we are at it, make sure that
stream->urb_size has always a valid value when we return from the
function, even when an error happens.

Fixes: efdc8a9585ce ("V4L/DVB (10295): uvcvideo: Retry URB buffers allocation when the system is low on memory.")
Reported-by: Itay Chamiel <itay.chamiel@q.ai>
Closes: https://lore.kernel.org/linux-media/CANiDSCsSoZf2LsCCoWAUbCg6tJT-ypXR1B85aa6rAdMVYr2iBQ@mail.gmail.com/T/#t
Co-developed-by: Itay Chamiel <itay.chamiel@q.ai>
Signed-off-by: Itay Chamiel <itay.chamiel@q.ai>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 drivers/media/usb/uvc/uvc_video.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 2094e059d7d39ac5a196cbbd58f9bc997f1c1557..ec76595f3c4be0f49b798ec663d6855d78ab21c4 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1812,7 +1812,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 		npackets = UVC_MAX_PACKETS;
 
 	/* Retry allocations until one succeed. */
-	for (; npackets > 1; npackets /= 2) {
+	for (; npackets > 0; npackets /= 2) {
 		stream->urb_size = psize * npackets;
 
 		for (i = 0; i < UVC_URBS; ++i) {
@@ -1837,6 +1837,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 	uvc_dbg(stream->dev, VIDEO,
 		"Failed to allocate URB buffers (%u bytes per packet)\n",
 		psize);
+	stream->urb_size = 0;
 	return 0;
 }
 

-- 
2.52.0.457.g6b5491de43-goog

Re: [PATCH 1/3] media: uvcvideo: Fix allocation for small frame sizes

[Laurent Pinchart]

Hi Ricardo,

Thank you for the patch.

On Wed, Jan 14, 2026 at 10:32:13AM +0000, Ricardo Ribalda wrote:
> If a frame has size of less or equal than one packet size
> uvc_alloc_urb_buffers() is unable to allocate memory for it due to a
> off-by-one error.
> 
> Fix the off-by-one-error and now that we are at it, make sure that
> stream->urb_size has always a valid value when we return from the
> function, even when an error happens.
> 
> Fixes: efdc8a9585ce ("V4L/DVB (10295): uvcvideo: Retry URB buffers allocation when the system is low on memory.")
> Reported-by: Itay Chamiel <itay.chamiel@q.ai>
> Closes: https://lore.kernel.org/linux-media/CANiDSCsSoZf2LsCCoWAUbCg6tJT-ypXR1B85aa6rAdMVYr2iBQ@mail.gmail.com/T/#t
> Co-developed-by: Itay Chamiel <itay.chamiel@q.ai>
> Signed-off-by: Itay Chamiel <itay.chamiel@q.ai>
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/usb/uvc/uvc_video.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
> index 2094e059d7d39ac5a196cbbd58f9bc997f1c1557..ec76595f3c4be0f49b798ec663d6855d78ab21c4 100644
> --- a/drivers/media/usb/uvc/uvc_video.c
> +++ b/drivers/media/usb/uvc/uvc_video.c
> @@ -1812,7 +1812,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  		npackets = UVC_MAX_PACKETS;
>  
>  	/* Retry allocations until one succeed. */
> -	for (; npackets > 1; npackets /= 2) {
> +	for (; npackets > 0; npackets /= 2) {
>  		stream->urb_size = psize * npackets;
>  
>  		for (i = 0; i < UVC_URBS; ++i) {
> @@ -1837,6 +1837,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  	uvc_dbg(stream->dev, VIDEO,
>  		"Failed to allocate URB buffers (%u bytes per packet)\n",
>  		psize);
> +	stream->urb_size = 0;
>  	return 0;
>  }
>  

-- 
Regards,

Laurent Pinchart

[PATCH 2/3] media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer

[Ricardo Ribalda]

The uvc_alloc_urb_buffer() function implicitly depended on the
stream->urb_size field, which was set by its caller,
uvc_alloc_urb_buffers(). This implicit data flow makes the code harder
to follow.

More importantly, stream->urb_size was updated within the allocation
loop before the allocation was confirmed to be successful. If the
allocation failed, the stream object would be left with a urb_size that
doesn't correspond to valid, allocated URB buffers.

Refactor uvc_alloc_urb_buffer() to accept the buffer size as an explicit
argument. This makes the function's dependencies clear and improves the
robustness of the error handling path. The stream->urb_size is now set only
after a complete and successful allocation.

This is a pure refactoring and introduces no functional changes.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 drivers/media/usb/uvc/uvc_video.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index ec76595f3c4be0f49b798ec663d6855d78ab21c4..59eb95a4b70c05b1a12986e908b7e9979b064fd0 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1771,12 +1771,13 @@ static void uvc_free_urb_buffers(struct uvc_streaming *stream)
 }
 
 static bool uvc_alloc_urb_buffer(struct uvc_streaming *stream,
-				 struct uvc_urb *uvc_urb, gfp_t gfp_flags)
+				 struct uvc_urb *uvc_urb, unsigned int size,
+				 gfp_t gfp_flags)
 {
 	struct usb_device *udev = stream->dev->udev;
 
-	uvc_urb->buffer = usb_alloc_noncoherent(udev, stream->urb_size,
-						gfp_flags, &uvc_urb->dma,
+	uvc_urb->buffer = usb_alloc_noncoherent(udev, size, gfp_flags,
+						&uvc_urb->dma,
 						uvc_stream_dir(stream),
 						&uvc_urb->sgt);
 	return !!uvc_urb->buffer;
@@ -1813,12 +1814,13 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 
 	/* Retry allocations until one succeed. */
 	for (; npackets > 0; npackets /= 2) {
-		stream->urb_size = psize * npackets;
+		unsigned int urb_size = psize * npackets;
 
 		for (i = 0; i < UVC_URBS; ++i) {
 			struct uvc_urb *uvc_urb = &stream->uvc_urb[i];
 
-			if (!uvc_alloc_urb_buffer(stream, uvc_urb, gfp_flags)) {
+			if (!uvc_alloc_urb_buffer(stream, uvc_urb, urb_size,
+						  gfp_flags)) {
 				uvc_free_urb_buffers(stream);
 				break;
 			}
@@ -1830,6 +1832,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 			uvc_dbg(stream->dev, VIDEO,
 				"Allocated %u URB buffers of %ux%u bytes each\n",
 				UVC_URBS, npackets, psize);
+			stream->urb_size = urb_size;
 			return npackets;
 		}
 	}
@@ -1837,7 +1840,6 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 	uvc_dbg(stream->dev, VIDEO,
 		"Failed to allocate URB buffers (%u bytes per packet)\n",
 		psize);
-	stream->urb_size = 0;
 	return 0;
 }
 

-- 
2.52.0.457.g6b5491de43-goog

Re: [PATCH 2/3] media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer

[Laurent Pinchart]

Hi Ricardo,

Thank you for the patch.

On Wed, Jan 14, 2026 at 10:32:14AM +0000, Ricardo Ribalda wrote:
> The uvc_alloc_urb_buffer() function implicitly depended on the
> stream->urb_size field, which was set by its caller,
> uvc_alloc_urb_buffers(). This implicit data flow makes the code harder
> to follow.
> 
> More importantly, stream->urb_size was updated within the allocation
> loop before the allocation was confirmed to be successful. If the
> allocation failed, the stream object would be left with a urb_size that
> doesn't correspond to valid, allocated URB buffers.
> 
> Refactor uvc_alloc_urb_buffer() to accept the buffer size as an explicit
> argument. This makes the function's dependencies clear and improves the
> robustness of the error handling path. The stream->urb_size is now set only
> after a complete and successful allocation.
> 
> This is a pure refactoring and introduces no functional changes.
> 
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>

It's cleaner indeed.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/usb/uvc/uvc_video.c | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
> index ec76595f3c4be0f49b798ec663d6855d78ab21c4..59eb95a4b70c05b1a12986e908b7e9979b064fd0 100644
> --- a/drivers/media/usb/uvc/uvc_video.c
> +++ b/drivers/media/usb/uvc/uvc_video.c
> @@ -1771,12 +1771,13 @@ static void uvc_free_urb_buffers(struct uvc_streaming *stream)
>  }
>  
>  static bool uvc_alloc_urb_buffer(struct uvc_streaming *stream,
> -				 struct uvc_urb *uvc_urb, gfp_t gfp_flags)
> +				 struct uvc_urb *uvc_urb, unsigned int size,
> +				 gfp_t gfp_flags)
>  {
>  	struct usb_device *udev = stream->dev->udev;
>  
> -	uvc_urb->buffer = usb_alloc_noncoherent(udev, stream->urb_size,
> -						gfp_flags, &uvc_urb->dma,
> +	uvc_urb->buffer = usb_alloc_noncoherent(udev, size, gfp_flags,
> +						&uvc_urb->dma,
>  						uvc_stream_dir(stream),
>  						&uvc_urb->sgt);
>  	return !!uvc_urb->buffer;
> @@ -1813,12 +1814,13 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  
>  	/* Retry allocations until one succeed. */
>  	for (; npackets > 0; npackets /= 2) {
> -		stream->urb_size = psize * npackets;
> +		unsigned int urb_size = psize * npackets;
>  
>  		for (i = 0; i < UVC_URBS; ++i) {
>  			struct uvc_urb *uvc_urb = &stream->uvc_urb[i];
>  
> -			if (!uvc_alloc_urb_buffer(stream, uvc_urb, gfp_flags)) {
> +			if (!uvc_alloc_urb_buffer(stream, uvc_urb, urb_size,
> +						  gfp_flags)) {
>  				uvc_free_urb_buffers(stream);
>  				break;
>  			}
> @@ -1830,6 +1832,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  			uvc_dbg(stream->dev, VIDEO,
>  				"Allocated %u URB buffers of %ux%u bytes each\n",
>  				UVC_URBS, npackets, psize);
> +			stream->urb_size = urb_size;
>  			return npackets;
>  		}
>  	}
> @@ -1837,7 +1840,6 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  	uvc_dbg(stream->dev, VIDEO,
>  		"Failed to allocate URB buffers (%u bytes per packet)\n",
>  		psize);
> -	stream->urb_size = 0;
>  	return 0;
>  }
>  

-- 
Regards,

Laurent Pinchart

[PATCH 3/3] media: uvcvideo: use min() for npacket calculation

[Ricardo Ribalda]

Make the code slightly more appealing by making use of min(). There
shall not be any functional change from this patch.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 drivers/media/usb/uvc/uvc_video.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 59eb95a4b70c05b1a12986e908b7e9979b064fd0..db02080f15772e0bc1d5cfcadd32463f4e6ea045 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1808,9 +1808,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 	 * Compute the number of packets. Bulk endpoints might transfer UVC
 	 * payloads across multiple URBs.
 	 */
-	npackets = DIV_ROUND_UP(size, psize);
-	if (npackets > UVC_MAX_PACKETS)
-		npackets = UVC_MAX_PACKETS;
+	npackets = min(UVC_MAX_PACKETS, DIV_ROUND_UP(size, psize));
 
 	/* Retry allocations until one succeed. */
 	for (; npackets > 0; npackets /= 2) {

-- 
2.52.0.457.g6b5491de43-goog

Re: [PATCH 3/3] media: uvcvideo: use min() for npacket calculation

[Laurent Pinchart]

Hi Ricardo,

Thank you for the patch.

On Wed, Jan 14, 2026 at 10:32:15AM +0000, Ricardo Ribalda wrote:
> Make the code slightly more appealing by making use of min(). There
> shall not be any functional change from this patch.
> 
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
>  drivers/media/usb/uvc/uvc_video.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
> index 59eb95a4b70c05b1a12986e908b7e9979b064fd0..db02080f15772e0bc1d5cfcadd32463f4e6ea045 100644
> --- a/drivers/media/usb/uvc/uvc_video.c
> +++ b/drivers/media/usb/uvc/uvc_video.c
> @@ -1808,9 +1808,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
>  	 * Compute the number of packets. Bulk endpoints might transfer UVC
>  	 * payloads across multiple URBs.
>  	 */
> -	npackets = DIV_ROUND_UP(size, psize);
> -	if (npackets > UVC_MAX_PACKETS)
> -		npackets = UVC_MAX_PACKETS;
> +	npackets = min(UVC_MAX_PACKETS, DIV_ROUND_UP(size, psize));

Do you think this improves readability ? I find the existing code easier
to read, its purpose is immediately clear: it computes npackets and
clamps it to a max value. With min() I have to pause and think.

I'll take patches 1/3 and 2/3 in my tree already as 1/3 fixes an issue.

>  
>  	/* Retry allocations until one succeed. */
>  	for (; npackets > 0; npackets /= 2) {

-- 
Regards,

Laurent Pinchart

Re: [PATCH 3/3] media: uvcvideo: use min() for npacket calculation

[Ricardo Ribalda]

Hi Laurent

On Thu, 22 Jan 2026 at 02:49, Laurent Pinchart
<laurent.pinchart@ideasonboard.com> wrote:
>
> Hi Ricardo,
>
> Thank you for the patch.
>
> On Wed, Jan 14, 2026 at 10:32:15AM +0000, Ricardo Ribalda wrote:
> > Make the code slightly more appealing by making use of min(). There
> > shall not be any functional change from this patch.
> >
> > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> > ---
> >  drivers/media/usb/uvc/uvc_video.c | 4 +---
> >  1 file changed, 1 insertion(+), 3 deletions(-)
> >
> > diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
> > index 59eb95a4b70c05b1a12986e908b7e9979b064fd0..db02080f15772e0bc1d5cfcadd32463f4e6ea045 100644
> > --- a/drivers/media/usb/uvc/uvc_video.c
> > +++ b/drivers/media/usb/uvc/uvc_video.c
> > @@ -1808,9 +1808,7 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
> >        * Compute the number of packets. Bulk endpoints might transfer UVC
> >        * payloads across multiple URBs.
> >        */
> > -     npackets = DIV_ROUND_UP(size, psize);
> > -     if (npackets > UVC_MAX_PACKETS)
> > -             npackets = UVC_MAX_PACKETS;
> > +     npackets = min(UVC_MAX_PACKETS, DIV_ROUND_UP(size, psize));
>
> Do you think this improves readability ? I find the existing code easier
> to read, its purpose is immediately clear: it computes npackets and
> clamps it to a max value. With min() I have to pause and think.

I guess it is a matter of taste. I left it as a separate patch for that reason.

>
> I'll take patches 1/3 and 2/3 in my tree already as 1/3 fixes an issue.
Thanks!


Regards!

>
> >
> >       /* Retry allocations until one succeed. */
> >       for (; npackets > 0; npackets /= 2) {
>
> --
> Regards,
>
> Laurent Pinchart



-- 
Ricardo Ribalda

Re: [PATCH 0/3] media: uvcvideo: Fix allocation for small frame sizes

[Itay Chamiel]

The patchset looks great. For me it required a tiny bit of backporting because I'm running Ubuntu 24.04 and editing the version of the kernel that's running on my machine (6.8.0-90.91), and uvc_alloc_urb_buffer() looks a little different there. No issue though and my tests run fine; first I tested small and large frame sizes with my custom camera, and then I also verified that standard webcams didn't break.
For the whole series:
Tested-by: Itay Chamiel <itay.chamiel@q.ai>

________________________________________
From: Ricardo Ribalda <ribalda@chromium.org>
Sent: Wednesday, January 14, 2026 12:32 PM
To: Laurent Pinchart <laurent.pinchart@ideasonboard.com>; Hans de Goede <hansg@kernel.org>; Mauro Carvalho Chehab <mchehab@kernel.org>; Johannes Berg <johannes@sipsolutions.net>
Cc: Laurent Pinchart <laurent.pinchart@skynet.be>; linux-media@vger.kernel.org <linux-media@vger.kernel.org>; linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>; Ricardo Ribalda <ribalda@chromium.org>; Itay Chamiel <itay.chamiel@q.ai>
Subject: [PATCH 0/3] media: uvcvideo: Fix allocation for small frame sizes
 
This set fixes a bug in uvc_alloc_urb_buffers() and two more style
patches.

The first patch was Reported by Itay, who asked if I could prepare and
send the patch on his behalf.

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
Ricardo Ribalda (3):
      media: uvcvideo: Fix allocation for small frame sizes
      media: uvcvideo: Pass allocation size directly to uvc_alloc_urb_buffer
      media: uvcvideo: use min() for npacket calculation

 drivers/media/usb/uvc/uvc_video.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)
---
base-commit: 17526c7e69d07395e9d39794aacba42dcb02ff49
change-id: 20260114-uvc-alloc-urb-d1a0c617106a

Best regards,
--
Ricardo Ribalda <ribalda@chromium.org>