[PATCH 1/5] bcm2835-camera: Correct port_parameter_get return value

[Greg KH]

On Fri, Mar 17, 2017 at 02:56:42PM -0700, Michael Zoran wrote:
> From: Dave Stevenson <dave.stevenson at raspberrypi.org>
> 
> The API for port_parameter_get() requires that the
> filled length is returned, or if insufficient space
> that the required space is returned.
> 
> Signed-off-by: Dave Stevenson <dave.stevenson at raspberrypi.org>
> 
> Changed path:
> From: drivers/media/platform/bcm2835/mmal-vchiq.c
> To:   drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
> 
> Signed-off-by: Michael Zoran <mzoran at crowfest.net>
> ---
>  .../vc04_services/bcm2835-camera/mmal-vchiq.c        | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
> index fc1076db0f82..4f4499dfe0c3 100644
> --- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
> +++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c
> @@ -1422,6 +1422,7 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
>  	struct mmal_msg m;
>  	struct mmal_msg *rmsg;
>  	VCHI_HELD_MSG_T rmsg_handle;
> +	u32 reply_size;
>  
>  	m.h.type = MMAL_MSG_TYPE_PORT_PARAMETER_GET;
>  
> @@ -1445,19 +1446,30 @@ static int port_parameter_get(struct vchiq_mmal_instance *instance,
>  	}
>  
>  	ret = -rmsg->u.port_parameter_get_reply.status;
> -	if (ret || (rmsg->u.port_parameter_get_reply.size > *value_size)) {
> +	/*
> +	 * port_parameter_get_reply.size includes the header,
> +	 * whilst *value_size doesn't.
> +	 */
> +	reply_size = rmsg->u.port_parameter_get_reply.size - (2 * sizeof(u32));
> +
> +	if (ret || (reply_size > *value_size)) {
>  		/* Copy only as much as we have space for
>  		 * but report true size of parameter
>  		 */
>  		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
>  		       *value_size);
> -		*value_size = rmsg->u.port_parameter_get_reply.size;
>  	} else
>  		memcpy(value, &rmsg->u.port_parameter_get_reply.value,
> -		       rmsg->u.port_parameter_get_reply.size);
> +		       reply_size);
> +
> +	/*
> +	 * Return amount of data copied if big enough,
> +	 * or wanted if not big enough.
> +	 */
> +	*value_size = reply_size;
>  
>  	pr_debug("%s:result:%d component:0x%x port:%d parameter:%d\n", __func__,
> -		 ret, port->component->handle, port->handle, parameter_id);
> +	        ret, port->component->handle, port->handle, parameter_id);

Why did you change this last line?  It was previously correct.

thanks,

greg k-h