V4L/DVB (11945): uvcvideo: Don't accept to change the format when buffers are allocated.

Setting a new frame format or size will likely change the buffer size required
to store a complete video frame. To avoid a buffer overflow, don't allow
VIDIOC_S_FMT calls when video buffers are already allocated.

Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index 0155752e4a5aea54140c55044a266df1099b8575..f854698c40618a4a5225209f1060933f1aafb430 100644 (file)
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -172,6 +172,20 @@ int uvc_free_buffers(struct uvc_video_queue *queue)
        return 0;
 }
 
+/*
+ * Check if buffers have been allocated.
+ */
+int uvc_queue_allocated(struct uvc_video_queue *queue)
+{
+       int allocated;
+
+       mutex_lock(&queue->mutex);
+       allocated = queue->count != 0;
+       mutex_unlock(&queue->mutex);
+
+       return allocated;
+}
+
 static void __uvc_query_buffer(struct uvc_buffer *buf,
                struct v4l2_buffer *v4l2_buf)
 {

diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index 507542dcbdaea0e22c073b5555bb426ecf620daa..f8b94d608a102af72ac30b3c11f9cdda422f0a79 100644 (file)
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -251,7 +251,7 @@ static int uvc_v4l2_set_format(struct uvc_video_device *video,
        if (fmt->type != video->streaming->type)
                return -EINVAL;
 
-       if (uvc_queue_streaming(&video->queue))
+       if (uvc_queue_allocated(&video->queue))
                return -EBUSY;
 
        ret = uvc_v4l2_try_format(video, fmt, &probe, &format, &frame);

diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index f435e8eeccd261bd5823ced9838c12a7f39aca98..3c78d3c1e4c0f7482122d7ddff4ea2c0411fea2e 100644 (file)
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -747,6 +747,7 @@ extern struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
                struct uvc_buffer *buf);
 extern unsigned int uvc_queue_poll(struct uvc_video_queue *queue,
                struct file *file, poll_table *wait);
+extern int uvc_queue_allocated(struct uvc_video_queue *queue);
 static inline int uvc_queue_streaming(struct uvc_video_queue *queue)
 {
        return queue->flags & UVC_QUEUE_STREAMING;