media: platform: Improve queue set up flow for bug fixing

[ Upstream commit 5095a6413a0cf896ab468009b6142cb0fe617e66 ]

Add checking created buffer size follow in mtk_jpeg_queue_setup().

Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Xia Jiang <xia.jiang@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index 46c996936798a0e77bc9d6ab64873514c43a2278..fd9e13500fe7f2c41f096b2f99160f7ac1101bb6 100644 (file)
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -579,6 +579,13 @@ static int mtk_jpeg_queue_setup(struct vb2_queue *q,
        if (!q_data)
                return -EINVAL;
 
+       if (*num_planes) {
+               for (i = 0; i < *num_planes; i++)
+                       if (sizes[i] < q_data->sizeimage[i])
+                               return -EINVAL;
+               return 0;
+       }
+
        *num_planes = q_data->fmt->colplanes;
        for (i = 0; i < q_data->fmt->colplanes; i++) {
                sizes[i] = q_data->sizeimage[i];