MLK-21543 media: mxc v4l2 capture: Fix v4l2_buffer offset = 0 via QUERYBUF
authorRobby Cai <robby.cai@nxp.com>
Wed, 24 Apr 2019 07:09:53 +0000 (15:09 +0800)
committerRobby Cai <robby.cai@nxp.com>
Wed, 24 Apr 2019 08:38:14 +0000 (16:38 +0800)
The commit 04f4e9e44fd4d2f2379e46e48f26101acb88dfdc fixed compilation warning
for memset, which just reveals the bug: in VIDIOC_QUERYBUF code section,
it judges buf->memory against V4L2_MEMORY_MMAP twice, but buf->memory is just
reset to 0 by memset after first judgement thus the second one comes wrong.
Consequently, it will provide an offset of 0 to usespace, obviously it's wrong.

This patch fixed it.

Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu.Zhou <guoniu.zhou@nxp.com>
drivers/media/platform/mxc/capture/mxc_v4l2_capture.c

index dd9b860..c8e61b7 100644 (file)
@@ -1999,19 +1999,17 @@ static long mxc_v4l_do_ioctl(struct file *file,
                        break;
                }
 
-               if (buf->memory & V4L2_MEMORY_MMAP) {
-                       memset(buf, 0, sizeof(*buf));
-                       buf->index = index;
-               }
-
                down(&cam->param_lock);
                if (buf->memory & V4L2_MEMORY_USERPTR) {
                        mxc_v4l2_release_bufs(cam);
                        retval = mxc_v4l2_prepare_bufs(cam, buf);
                }
 
-               if (buf->memory & V4L2_MEMORY_MMAP)
+               if (buf->memory & V4L2_MEMORY_MMAP) {
+                       memset(buf, 0, sizeof(*buf));
+                       buf->index = index;
                        retval = mxc_v4l2_buffer_status(cam, buf);
+               }
                up(&cam->param_lock);
                break;
        }