From: Xinyu Chen <b03824@freescale.com>
Date: Fri, 9 Dec 2011 06:47:57 +0000 (+0800)
Subject: ENGR00169891 v4l2 capture: avoid streamon with only one buffer queued
X-Git-Tag: v3.0.35-fsl~1795
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=0d34c6c6eeb6159370db6e7dc85d730e562048c5;p=karo-tx-linux.git

ENGR00169891 v4l2 capture: avoid streamon with only one buffer queued

If user space only queue one buffer into ready list, and
call streamon, camera csi enc ISR will crash.
Since for CSI ENC, the ping pong buffer is initilized without
checking ready buffer on streamon.
The second buffer will be wrongly in cam_data struct, and causes
DMA fill buffers into cam_data global variable.
Here just add one sanity check for ready buffer.

Signed-off-by: Xinyu Chen <xinyu.chen@freescale.com>
---

diff --git a/drivers/media/video/mxc/capture/mxc_v4l2_capture.c b/drivers/media/video/mxc/capture/mxc_v4l2_capture.c
index a6045061f505..e4108c291c40 100644
--- a/drivers/media/video/mxc/capture/mxc_v4l2_capture.c
+++ b/drivers/media/video/mxc/capture/mxc_v4l2_capture.c
@@ -382,6 +382,12 @@ static int mxc_streamon(cam_data *cam)
 			"queued yet\n");
 		return -EINVAL;
 	}
+	if (cam->enc_update_eba &&
+		cam->ready_q.prev == cam->ready_q.next) {
+		pr_err("ERROR: v4l2 capture: mxc_streamon buffer need ping pong "
+			"at least two buffers\n");
+		return -EINVAL;
+	}
 
 	cam->capture_pid = current->pid;