The check for the number of buffers requested against the maximum, VB2_MAX_FRAME, was performed before checking queue's minimum number of buffers. Reverse the order, thus ensuring that under no circumstances num_buffers exceeds VB2_MAX_FRAME here. Also add a warning of the condition. Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx> --- drivers/media/v4l2-core/videobuf2-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index a8589d96ef72..7cade8189bf2 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -696,8 +696,9 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, /* * Make sure the requested values and current defaults are sane. */ - num_buffers = min_t(unsigned int, *count, VB2_MAX_FRAME); - num_buffers = max_t(unsigned int, num_buffers, q->min_buffers_needed); + WARN_ON(q->min_buffers_needed > VB2_MAX_FRAME); + num_buffers = max_t(unsigned int, *count, q->min_buffers_needed); + num_buffers = min_t(unsigned int, num_buffers, VB2_MAX_FRAME); memset(q->alloc_devs, 0, sizeof(q->alloc_devs)); q->memory = memory; -- 2.11.0
