[media] s5p-fimc: Fix wrong buffer size in queue_setup

Avoid dereferencing of NULL f->fmt. Correct size of the allocated
buffer in case the crop rectangle is smaller than the bounds
rectangle (configured with S_FMT). Also remove redundant check
for *num_buffer == 0 as this case is handled in videobuf2.

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 4 insertions, 8 deletions

diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index c427edd3cd5e..85b47a328a5d 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -704,22 +704,18 @@ static int fimc_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers,
         f = ctx_get_frame(ctx, vq->type);
         if (IS_ERR(f))
                 return PTR_ERR(f);
-
         /*
          * Return number of non-contigous planes (plane buffers)
          * depending on the configured color format.
          */
-        if (f->fmt)
-                *num_planes = f->fmt->memplanes;
+        if (!f->fmt)
+                return -EINVAL;
 
+        *num_planes = f->fmt->memplanes;
         for (i = 0; i < f->fmt->memplanes; i++) {
-                sizes[i] = (f->width * f->height * f->fmt->depth[i]) >> 3;
+                sizes[i] = (f->f_width * f->f_height * f->fmt->depth[i]) / 8;
                 allocators[i] = ctx->fimc_dev->alloc_ctx;
         }
-
-        if (*num_buffers == 0)
-                *num_buffers = 1;
-
         return 0;
 }