[PATCH 1/5] bcm2835-camera: Correct port_parameter_get return value

[Michael Zoran]

From: Dave Stevenson <dave.steven...@raspberrypi.org>

The API for port_parameter_get() requires that the
filled length is returned, or if insufficient space
that the required space is returned.

Signed-off-by: Dave Stevenson <dave.steven...@raspberrypi.org>

Changed path:
From: drivers/media/platform/bcm2835/mmal-vchiq.c
To:   drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c

Signed-off-by: Michael Zoran <mzo...@crowfest.net>
---
 .../vc04_services/bcm2835-camera/mmal-vchiq.c        | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c 
b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
index fc1076db0f82..4f4499dfe0c3 100644
--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
+++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
@@ -1422,6 +1422,7 @@ static int port_parameter_get(struct vchiq_mmal_instance 
*instance,
        struct mmal_msg m;
        struct mmal_msg *rmsg;
        VCHI_HELD_MSG_T rmsg_handle;
+       u32 reply_size;
 
        m.h.type = MMAL_MSG_TYPE_PORT_PARAMETER_GET;
 
@@ -1445,19 +1446,30 @@ static int port_parameter_get(struct 
vchiq_mmal_instance *instance,
        }
 
        ret = -rmsg->u.port_parameter_get_reply.status;
-       if (ret || (rmsg->u.port_parameter_get_reply.size > *value_size)) {
+       /*
+        * port_parameter_get_reply.size includes the header,
+        * whilst *value_size doesn't.
+        */
+       reply_size = rmsg->u.port_parameter_get_reply.size - (2 * sizeof(u32));
+
+       if (ret || (reply_size > *value_size)) {
                /* Copy only as much as we have space for
                 * but report true size of parameter
                 */
                memcpy(value, &rmsg->u.port_parameter_get_reply.value,
                       *value_size);
-               *value_size = rmsg->u.port_parameter_get_reply.size;
        } else
                memcpy(value, &rmsg->u.port_parameter_get_reply.value,
-                      rmsg->u.port_parameter_get_reply.size);
+                      reply_size);
+
+       /*
+        * Return amount of data copied if big enough,
+        * or wanted if not big enough.
+        */
+       *value_size = reply_size;
 
        pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
-                ret, port->component->handle, port->handle, parameter_id);
+               ret, port->component->handle, port->handle, parameter_id);
 
 release_msg:
        vchi_held_msg_release(&rmsg_handle);
-- 
2.11.0

_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel