[PATCH 1/5] bcm2835-camera: Correct port_parameter_get return value

[Michael Zoran <mzoran@xxxxxxxxxxxx>]

From: Dave Stevenson <dave.stevenson@xxxxxxxxxxxxxxx>

The API for port_parameter_get() requires that the
filled length is returned, or if insufficient space
that the required space is returned.

Signed-off-by: Dave Stevenson <dave.stevenson@xxxxxxxxxxxxxxx>

Changed path:
From: drivers/media/platform/bcm2835/mmal-vchiq.c
To:   drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c

Signed-off-by: Michael Zoran <mzoran@xxxxxxxxxxxx>
---
 .../vc04_services/bcm2835-camera/mmal-vchiq.c        | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index fc1076db0f82..4f4499dfe0c3 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -1422,6 +1422,7 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
 	struct mmal_msg m;
 	struct mmal_msg *rmsg;
 	VCHI_HELD_MSG_T rmsg_handle;
+	u32 reply_size;
 
 	m.h.type = MMAL_MSG_TYPE_PORT_PARAMETER_GET;
 
@@ -1445,19 +1446,30 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
 	}
 
 	ret = -rmsg->u.port_parameter_get_reply.status;
-	if (ret || (rmsg->u.port_parameter_get_reply.size > *value_size)) {
+	/*
+	 * port_parameter_get_reply.size includes the header,
+	 * whilst *value_size doesn't.
+	 */
+	reply_size = rmsg->u.port_parameter_get_reply.size - (2 * sizeof(u32));
+
+	if (ret || (reply_size > *value_size)) {
 		/* Copy only as much as we have space for
 		 * but report true size of parameter
 		 */
 		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
 		       *value_size);
-		*value_size = rmsg->u.port_parameter_get_reply.size;
 	} else
 		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
-		       rmsg->u.port_parameter_get_reply.size);
+		       reply_size);
+
+	/*
+	 * Return amount of data copied if big enough,
+	 * or wanted if not big enough.
+	 */
+	*value_size = reply_size;
 
 	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
-		 ret, port->component->handle, port->handle, parameter_id);
+	        ret, port->component->handle, port->handle, parameter_id);
 
 release_msg:
 	vchi_held_msg_release(&rmsg_handle);
-- 
2.11.0

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel