media: omap_vout: potential buffer overflow in vidioc_dqbuf()

[mirror_ubuntu-bionic-kernel.git] / drivers / media / platform / omap / omap_vout.c

diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
index 6f1b0c799e58d7282f6949cbf578e4885de92766..eb201a184f5a08c88915624467bfaad1fab8698e 100644 (file)
--- a/drivers/media/platform/omap/omap_vout.c
+++ b/drivers/media/platform/omap/omap_vout.c
@@ -1528,23 +1528,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
        unsigned long size;
        struct videobuf_buffer *vb;
 
-       vb = q->bufs[b->index];
-
        if (!vout->streaming)
                return -EINVAL;
 
-       if (file->f_flags & O_NONBLOCK)
-               /* Call videobuf_dqbuf for non blocking mode */
-               ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
-       else
-               /* Call videobuf_dqbuf for  blocking mode */
-               ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
+       ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
+       if (ret)
+               return ret;
+
+       vb = q->bufs[b->index];
 
        addr = (unsigned long) vout->buf_phy_addr[vb->i];
        size = (unsigned long) vb->size;
        dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
                                size, DMA_TO_DEVICE);
-       return ret;
+       return 0;
 }
 
 static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)