On Tue, Mar 11, 2014 at 6:20 AM, Hans Verkuil <hverkuil@xxxxxxxxx> wrote:
> From: Hans Verkuil <hans.verkuil@xxxxxxxxx>
>
> The videobuf2-core did not zero the reserved array of v4l2_plane as it
> should.
>
> More serious is the fact that data_offset was not handled correctly:
>
> - for capture devices it was never zeroed, which meant that it was
> uninitialized. Unless the driver sets it it was a completely random
> number.
>
> - __qbuf_dmabuf had a completely incorrect length check that included
> data_offset.
>
> - in the single-planar case data_offset was never correctly set to 0.
> The single-planar API doesn't support data_offset, so setting it
> to 0 is the right thing to do.
>
> All these issues were found with v4l2-compliance.
>
> Signed-off-by: Hans Verkuil <hans.verkuil@xxxxxxxxx>
> ---
> drivers/media/v4l2-core/videobuf2-core.c | 19 ++++++++++---------
> 1 file changed, 10 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
> index f9059bb..1a09442 100644
> --- a/drivers/media/v4l2-core/videobuf2-core.c
> +++ b/drivers/media/v4l2-core/videobuf2-core.c
> @@ -1141,6 +1141,12 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
> unsigned int plane;
>
> if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
> + for (plane = 0; plane < vb->num_planes; ++plane) {
> + memset(v4l2_planes[plane].reserved, 0,
> + sizeof(v4l2_planes[plane].reserved));
> + v4l2_planes[plane].data_offset = 0;
> + }
> +
Perhaps we should just memset the whole v4l2_planes array to 0 over
all elements (ARRAY_SIZE)?
Also I would extract this above the if and zero out everything for
both multi and singleplanar.
You shouldn't need to zero it out below then.
> /* Fill in driver-provided information for OUTPUT types */
> if (V4L2_TYPE_IS_OUTPUT(b->type)) {
> /*
> @@ -1169,8 +1175,6 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
> b->m.planes[plane].m.fd;
> v4l2_planes[plane].length =
> b->m.planes[plane].length;
> - v4l2_planes[plane].data_offset =
> - b->m.planes[plane].data_offset;
> }
> }
> } else {
> @@ -1180,10 +1184,10 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
> * In videobuf we use our internal V4l2_planes struct for
> * single-planar buffers as well, for simplicity.
> */
> - if (V4L2_TYPE_IS_OUTPUT(b->type)) {
> + if (V4L2_TYPE_IS_OUTPUT(b->type))
> v4l2_planes[0].bytesused = b->bytesused;
> - v4l2_planes[0].data_offset = 0;
> - }
> + /* Single-planar buffers never use data_offset */
> + v4l2_planes[0].data_offset = 0;
>
> if (b->memory == V4L2_MEMORY_USERPTR) {
> v4l2_planes[0].m.userptr = b->m.userptr;
> @@ -1193,9 +1197,7 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
> if (b->memory == V4L2_MEMORY_DMABUF) {
> v4l2_planes[0].m.fd = b->m.fd;
> v4l2_planes[0].length = b->length;
> - v4l2_planes[0].data_offset = 0;
> }
> -
> }
>
> /* Zero flags that the vb2 core handles */
> @@ -1374,8 +1376,7 @@ static int __qbuf_dmabuf(struct vb2_buffer *vb, const struct v4l2_buffer *b)
> if (planes[plane].length == 0)
> planes[plane].length = dbuf->size;
>
> - if (planes[plane].length < planes[plane].data_offset +
> - q->plane_sizes[plane]) {
> + if (planes[plane].length < q->plane_sizes[plane]) {
Good catch!
> dprintk(1, "qbuf: invalid dmabuf length for plane %d\n",
> plane);
> ret = -EINVAL;
> --
> 1.9.0
>
--
Best regards,
Pawel Osciak
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
