From 8f3a307b9afd8c2ebde46ef317df4df3813301a7 Mon Sep 17 00:00:00 2001 From: Vaibhav Hiremath Date: Thu, 16 Jun 2011 15:32:07 -0300 Subject: [media] OMAP_VOUT: Change hardcoded device node number to -1 With addition of media-controller framework, now we have various device nodes (/dev/videoX) getting created, so hardcoding minor number in video_register_device() is not recommended. So let V4L2 framework choose free minor number for the device. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/omap/omap_vout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media/video/omap/omap_vout.c') diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c index 4ada9be1d430..eb16607358d0 100644 --- a/drivers/media/video/omap/omap_vout.c +++ b/drivers/media/video/omap/omap_vout.c @@ -2391,7 +2391,7 @@ static int __init omap_vout_create_video_devices(struct platform_device *pdev) /* Register the Video device with V4L2 */ vfd = vout->vfd; - if (video_register_device(vfd, VFL_TYPE_GRABBER, k + 1) < 0) { + if (video_register_device(vfd, VFL_TYPE_GRABBER, -1) < 0) { dev_err(&pdev->dev, ": Could not register " "Video for Linux device\n"); vfd->minor = -1; -- cgit From 383e4f69879d11c86ebdd38b3356f6d0690fb4cc Mon Sep 17 00:00:00 2001 From: Vaibhav Hiremath Date: Thu, 14 Apr 2011 13:42:34 -0300 Subject: [media] omap_vout: Added check in reqbuf & mmap for buf_size allocation The usecase where, user allocates small size of buffer through bootargs (video1_bufsize/video2_bufsize) and later from application tries to set the format which requires larger buffer size, driver doesn't check for insufficient buffer size and allows application to map extra buffer. This leads to kernel crash, when user application tries to access memory beyond the allocation size. Added check in both mmap and reqbuf call back function, and return error if the size of the buffer allocated by user through bootargs is less than the S_FMT size. Signed-off-by: Vaibhav Hiremath Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/omap/omap_vout.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'drivers/media/video/omap/omap_vout.c') diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c index eb16607358d0..4d07c5844402 100644 --- a/drivers/media/video/omap/omap_vout.c +++ b/drivers/media/video/omap/omap_vout.c @@ -982,6 +982,14 @@ static int omap_vout_buffer_setup(struct videobuf_queue *q, unsigned int *count, startindex = (vout->vid == OMAP_VIDEO1) ? video1_numbuffers : video2_numbuffers; + /* Check the size of the buffer */ + if (*size > vout->buffer_size) { + v4l2_err(&vout->vid_dev->v4l2_dev, + "buffer allocation mismatch [%u] [%u]\n", + *size, vout->buffer_size); + return -ENOMEM; + } + for (i = startindex; i < *count; i++) { vout->buffer_size = *size; @@ -1228,6 +1236,14 @@ static int omap_vout_mmap(struct file *file, struct vm_area_struct *vma) (vma->vm_pgoff << PAGE_SHIFT)); return -EINVAL; } + /* Check the size of the buffer */ + if (size > vout->buffer_size) { + v4l2_err(&vout->vid_dev->v4l2_dev, + "insufficient memory [%lu] [%u]\n", + size, vout->buffer_size); + return -ENOMEM; + } + q->bufs[i]->baddr = vma->vm_start; vma->vm_flags |= VM_RESERVED; -- cgit