media: platform: Improve queue set up flow for bug fixing

[ Upstream commit 5095a6413a0cf896ab468009b6142cb0fe617e66 ]

Add checking created buffer size follow in mtk_jpeg_queue_setup().

Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Xia Jiang <xia.jiang@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index 61fed1e35a005dcf4d0f841553c90a6a1a567538..b1ca4e3adae3249286015f4752c8057b4ac99da8 100644 (file)
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -571,6 +571,13 @@ static int mtk_jpeg_queue_setup(struct vb2_queue *q,
        if (!q_data)
                return -EINVAL;
 
+       if (*num_planes) {
+               for (i = 0; i < *num_planes; i++)
+                       if (sizes[i] < q_data->sizeimage[i])
+                               return -EINVAL;
+               return 0;
+       }
+
        *num_planes = q_data->fmt->colplanes;
        for (i = 0; i < q_data->fmt->colplanes; i++) {
                sizes[i] = q_data->sizeimage[i];