If there in an error during a set_fmt, do not overwrite the previous
sizes with the invalid config.

[   38.662975] ipu3-imgu 0000:00:05.0: swiotlb buffer is full (sz: 4096 bytes)
[   38.662980] DMA: Out of SW-IOMMU space for 4096 bytes at device 0000:00:05.0
[   38.663010] general protection fault: 0000 [#1] PREEMPT SMP

Cc: sta...@vger.kernel.org
Fixes: 6d5f26f2e045 ("media: staging/intel-ipu3-v4l: reduce kernel stack usage")
Signed-off-by: Ricardo Ribalda <riba...@chromium.org>
---
 drivers/staging/media/ipu3/ipu3-v4l2.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c 
b/drivers/staging/media/ipu3/ipu3-v4l2.c
index 35a74d99322f..6d9c49b39531 100644
--- a/drivers/staging/media/ipu3/ipu3-v4l2.c
+++ b/drivers/staging/media/ipu3/ipu3-v4l2.c
@@ -686,6 +686,7 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int 
pipe, int node,
 
        dev_dbg(dev, "IPU3 pipe %u pipe_id = %u", pipe, css_pipe->pipe_id);
 
+       css_q = imgu_node_to_queue(node);
        for (i = 0; i < IPU3_CSS_QUEUES; i++) {
                unsigned int inode = imgu_map_node(imgu, i);
 
@@ -700,6 +701,11 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int 
pipe, int node,
                        continue;
                }
 
+               if (i == css_q) {
+                       fmts[i] = &f->fmt.pix_mp;
+                       continue;
+               }
+
                if (try) {
                        fmts[i] = 
kmemdup(&imgu_pipe->nodes[inode].vdev_fmt.fmt.pix_mp,
                                          sizeof(struct v4l2_pix_format_mplane),
@@ -728,16 +734,10 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned 
int pipe, int node,
                rects[IPU3_CSS_RECT_GDC]->height = pad_fmt.height;
        }
 
-       /*
-        * imgu doesn't set the node to the value given by user
-        * before we return success from this function, so set it here.
-        */
-       css_q = imgu_node_to_queue(node);
        if (!fmts[css_q]) {
                ret = -EINVAL;
                goto out;
        }
-       *fmts[css_q] = f->fmt.pix_mp;
 
        if (try)
                ret = imgu_css_fmt_try(&imgu->css, fmts, rects, pipe);
@@ -748,15 +748,18 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned 
int pipe, int node,
        if (ret < 0)
                goto out;
 
-       if (try)
-               f->fmt.pix_mp = *fmts[css_q];
-       else
-               f->fmt = imgu_pipe->nodes[node].vdev_fmt.fmt;
+       /*
+        * imgu doesn't set the node to the value given by user
+        * before we return success from this function, so set it here.
+        */
+       if (!try)
+               imgu_pipe->nodes[node].vdev_fmt.fmt.pix_mp = f->fmt.pix_mp;
 
 out:
        if (try) {
                for (i = 0; i < IPU3_CSS_QUEUES; i++)
-                       kfree(fmts[i]);
+                       if (i != css_q)
+                               kfree(fmts[i]);
        }
 
        return ret;
-- 
2.31.0.rc2.261.g7f71774620-goog

_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Reply via email to