media: platform: Improve queue set up flow for bug fixing

Add checking created buffer size follow in mtk_jpeg_queue_setup().

Reviewed-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Xia Jiang <xia.jiang@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index d1b13556e18b36a7e8da502e4928016f840386dd..93347ab9b9533e0197ae1655eb8a379851fbde0e 100644 (file)
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -571,6 +571,13 @@ static int mtk_jpeg_queue_setup(struct vb2_queue *q,
        if (!q_data)
                return -EINVAL;
 
+       if (*num_planes) {
+               for (i = 0; i < *num_planes; i++)
+                       if (sizes[i] < q_data->sizeimage[i])
+                               return -EINVAL;
+               return 0;
+       }
+
        *num_planes = q_data->fmt->colplanes;
        for (i = 0; i < q_data->fmt->colplanes; i++) {
                sizes[i] = q_data->sizeimage[i];