| From dc545ae123d0369690794e2a137b4c086aac8167 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 5 May 2021 14:23:45 +0200 |
| Subject: media: rkvdec: Fix .buf_prepare |
| |
| From: Ezequiel Garcia <ezequiel@collabora.com> |
| |
| [ Upstream commit ba1ed4ae760a81caf39f54232e089d95157a0dba ] |
| |
| The driver should only set the payload on .buf_prepare if the |
| buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused |
| set by userspace then v4l2-core will set it to buffer length. |
| |
| If we overwrite bytesused for OUTPUT buffers, too, then |
| vb2_get_plane_payload() will return incorrect value which might be then |
| written to hw registers by the driver in rkvdec-h264.c. |
| |
| [Changed the comment and used V4L2_TYPE_IS_CAPTURE macro] |
| |
| Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") |
| Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com> |
| Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> |
| Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- |
| 1 file changed, 9 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c |
| index b630e161d4ce..e68303e2b390 100644 |
| --- a/drivers/staging/media/rkvdec/rkvdec.c |
| +++ b/drivers/staging/media/rkvdec/rkvdec.c |
| @@ -471,7 +471,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) |
| if (vb2_plane_size(vb, i) < sizeimage) |
| return -EINVAL; |
| } |
| - vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); |
| + |
| + /* |
| + * Buffer's bytesused must be written by driver for CAPTURE buffers. |
| + * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets |
| + * it to buffer length). |
| + */ |
| + if (V4L2_TYPE_IS_CAPTURE(vq->type)) |
| + vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); |
| + |
| return 0; |
| } |
| |
| -- |
| 2.30.2 |
| |
