Import G955FXXUCDUD1/G950FXXUCDUD1+N950FXXSGDUG7 kernel source

[GitHub/exynos8895/android_kernel_samsung_universal8895.git] / drivers / media / platform / exynos / mfc / s5p_mfc_enc.c

diff --git a/drivers/media/platform/exynos/mfc/s5p_mfc_enc.c b/drivers/media/platform/exynos/mfc/s5p_mfc_enc.c
index df4ebc4ec90ed006148a6f920714f7f8783b44b2..25e8a95b7c25ef573742ad3a698828a73ad9511d 100644 (file)
--- a/drivers/media/platform/exynos/mfc/s5p_mfc_enc.c
+++ b/drivers/media/platform/exynos/mfc/s5p_mfc_enc.c
@@ -278,7 +278,7 @@ static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
        struct s5p_mfc_dev *dev = video_drvdata(file);
        struct s5p_mfc_ctx *ctx = fh_to_mfc_ctx(file->private_data);
        struct s5p_mfc_enc *enc = ctx->enc_priv;
-       struct s5p_mfc_fmt *fmt;
+       struct s5p_mfc_fmt *fmt = NULL;
        struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
        int ret = 0;
 
@@ -568,13 +568,25 @@ static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
                return -EIO;
        }
 
-       if (V4L2_TYPE_IS_MULTIPLANAR(buf->type) && !buf->length) {
+       if (!V4L2_TYPE_IS_MULTIPLANAR(buf->type)) {
+               mfc_err_ctx("Invalid V4L2 Buffer for driver: type(%d)\n", buf->type);
+               return -EINVAL;
+       }
+
+       if (!buf->length) {
                mfc_err_ctx("multiplanar but length is zero\n");
                return -EIO;
        }
 
        if (buf->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
-               for (i = 0; i < ctx->src_fmt->num_planes; i++) {
+               if (ctx->src_fmt->mem_planes != buf->length) {
+                       mfc_err_ctx("number of memory container miss-match "
+                                       "between Src planes(%d) and buffer length(%d)\n",
+                                       ctx->src_fmt->mem_planes, buf->length);
+                       return -EINVAL;
+               }
+
+               for (i = 0; i < ctx->src_fmt->mem_planes; i++) {
                        if (!buf->m.planes[i].bytesused) {
                                mfc_debug(2, "Src input[%d] size zero, "
                                                "changed to buf size %d\n",
@@ -607,6 +619,12 @@ static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
                mfc_err_ctx("Call on DQBUF after unrecoverable error.\n");
                return -EIO;
        }
+
+       if (!V4L2_TYPE_IS_MULTIPLANAR(buf->type)) {
+               mfc_err_ctx("Invalid V4L2 Buffer for driver: type(%d)\n", buf->type);
+               return -EINVAL;
+       }
+
        if (buf->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
                ret = vb2_dqbuf(&ctx->vq_src, buf, file->f_flags & O_NONBLOCK);
        else
@@ -623,6 +641,12 @@ static int vidioc_streamon(struct file *file, void *priv,
        int ret = -EINVAL;
 
        mfc_debug_enter();
+
+       if (!V4L2_TYPE_IS_MULTIPLANAR(type)) {
+               mfc_err_ctx("Invalid V4L2 Buffer for driver: type(%d)\n", type);
+               return -EINVAL;
+       }
+
        if (type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
                ret = vb2_streamon(&ctx->vq_src, type);
 
@@ -645,10 +669,15 @@ static int vidioc_streamoff(struct file *file, void *priv,
                            enum v4l2_buf_type type)
 {
        struct s5p_mfc_ctx *ctx = fh_to_mfc_ctx(file->private_data);
-       int ret;
+       int ret = -EINVAL;
 
        mfc_debug_enter();
-       ret = -EINVAL;
+
+       if (!V4L2_TYPE_IS_MULTIPLANAR(type)) {
+               mfc_err_ctx("Invalid V4L2 Buffer for driver: type(%d)\n", type);
+               return -EINVAL;
+       }
+
        if (type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
                s5p_mfc_qos_reset_last_framerate(ctx);