casaroli commented on code in PR #21471:
URL: https://github.com/apache/nuttx/pull/21471#discussion_r4490137575
##########
drivers/video/v4l2_cap.c:
##########
@@ -4194,16 +4302,20 @@ static int capture_unlink(FAR struct inode *inode)
}
nxmutex_lock(&cmng->mutex);
+ cmng->unlinked = true;
+
if (cmng->open_num == 0)
{
+ inode->i_private = NULL;
nxmutex_unlock(&cmng->mutex);
+ cleanup_resources(cmng);
Review Comment:
At `open_num == 0` nothing is initialized: `capture_open()` is the only
INIT, and `capture_close()` already ran these three at the last close. `rm
/dev/video0` on a device never opened calls `nxmutex_lock()` on `lock_empty`,
which was never initialized in the `kmm_zalloc`ed `cmng`, and blocks for ever;
after an open and close, the sensor is uninitialized twice.
Fix: remove `cleanup_resources()`, `IMGSENSOR_UNINIT()` and
`IMGDATA_UNINIT()` from this path; keep the `i_private` and `unlinked` changes.
##########
drivers/video/v4l2_cap.c:
##########
@@ -2548,15 +2581,42 @@ static int capture_qbuf(FAR struct file *filep,
FAR capture_mng_t *cmng = inode->i_private;
FAR capture_type_inf_t *type_inf;
FAR vbuf_container_t *container;
+ FAR vbuf_container_t *queued;
enum capture_state_e next_capture_state;
+ int ret = OK;
if (cmng == NULL || buf == NULL)
{
return -EINVAL;
}
type_inf = get_capture_type_inf(cmng, buf->type);
- if (type_inf == NULL)
+ if (type_inf == NULL ||
+ buf->index >= type_inf->bufinf.container_size)
+ {
+ return -EINVAL;
+ }
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+ if (buf->memory != V4L2_MEMORY_MMAP &&
+ buf->memory != V4L2_MEMORY_USERPTR &&
+ buf->memory != V4L2_MEMORY_DMABUF)
+#else
+ if (buf->memory != V4L2_MEMORY_MMAP &&
+ buf->memory != V4L2_MEMORY_USERPTR)
+#endif
+ {
+ return -EINVAL;
+ }
+
+ if (buf->memory == V4L2_MEMORY_MMAP && type_inf->bufheap == NULL)
+ {
+ return -EINVAL;
+ }
+
+ if (buf->memory == V4L2_MEMORY_USERPTR &&
+ (buf->m.userptr == 0 ||
+ buf->length < get_bufsize(&type_inf->fmt[CAPTURE_FMT_MAIN])))
Review Comment:
This rejects a JPEG USERPTR buffer that master accepts. For JPEG with
`sizeimage` 0, `get_bufsize()` is `width * height`; `apps/examples/camera` sets
no `sizeimage` and queues 512 KiB for FullHD (`IMAGE_JPG_SIZE`), which is 2 MB
here, so QBUF returns EINVAL when it falls back to USERPTR.
Fix: do this length test only for uncompressed formats, or only when
`sizeimage` is non-zero for JPEG and `V4L2_PIX_FMT_ENTROPY`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
