1 files changed, 37 insertions, 11 deletions

diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index c359006074a8..25d3ae2188cb 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -971,6 +971,7 @@ static int __reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
          * to the userspace.
          */
         req->count = allocated_buffers;
+        q->waiting_for_buffers = !V4L2_TYPE_IS_OUTPUT(q->type);
 
         return 0;
 }
@@ -1018,6 +1019,7 @@ static int __create_bufs(struct vb2_queue *q, struct v4l2_create_buffers *create
                 memset(q->plane_sizes, 0, sizeof(q->plane_sizes));
                 memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
                 q->memory = create->memory;
+                q->waiting_for_buffers = !V4L2_TYPE_IS_OUTPUT(q->type);
         }
 
         num_buffers = min(create->count, VIDEO_MAX_FRAME - q->num_buffers);
@@ -1130,7 +1132,7 @@ EXPORT_SYMBOL_GPL(vb2_plane_vaddr);
  */
 void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no)
 {
-        if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+        if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
                 return NULL;
 
         return call_ptr_memop(vb, cookie, vb->planes[plane_no].mem_priv);
@@ -1165,13 +1167,10 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
         if (WARN_ON(vb->state != VB2_BUF_STATE_ACTIVE))
                 return;
 
-        if (!q->start_streaming_called) {
-                if (WARN_ON(state != VB2_BUF_STATE_QUEUED))
-                        state = VB2_BUF_STATE_QUEUED;
-        } else if (WARN_ON(state != VB2_BUF_STATE_DONE &&
-                           state != VB2_BUF_STATE_ERROR)) {
-                        state = VB2_BUF_STATE_ERROR;
-        }
+        if (WARN_ON(state != VB2_BUF_STATE_DONE &&
+                    state != VB2_BUF_STATE_ERROR &&
+                    state != VB2_BUF_STATE_QUEUED))
+                state = VB2_BUF_STATE_ERROR;
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
         /*
@@ -1762,6 +1761,12 @@ static int vb2_start_streaming(struct vb2_queue *q)
         q->start_streaming_called = 0;
 
         dprintk(1, "driver refused to start streaming\n");
+        /*
+         * If you see this warning, then the driver isn't cleaning up properly
+         * after a failed start_streaming(). See the start_streaming()
+         * documentation in videobuf2-core.h for more information how buffers
+         * should be returned to vb2 in start_streaming().
+         */
         if (WARN_ON(atomic_read(&q->owned_by_drv_count))) {
                 unsigned i;
 
@@ -1777,6 +1782,12 @@ static int vb2_start_streaming(struct vb2_queue *q)
                 /* Must be zero now */
                 WARN_ON(atomic_read(&q->owned_by_drv_count));
         }
+        /*
+         * If done_list is not empty, then start_streaming() didn't call
+         * vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED) but STATE_ERROR or
+         * STATE_DONE.
+         */
+        WARN_ON(!list_empty(&q->done_list));
         return ret;
 }
 
@@ -1812,6 +1823,7 @@ static int vb2_internal_qbuf(struct vb2_queue *q, struct v4l2_buffer *b)
          */
         list_add_tail(&vb->queued_entry, &q->queued_list);
         q->queued_count++;
+        q->waiting_for_buffers = false;
         vb->state = VB2_BUF_STATE_QUEUED;
         if (V4L2_TYPE_IS_OUTPUT(q->type)) {
                 /*
@@ -2123,6 +2135,12 @@ static void __vb2_queue_cancel(struct vb2_queue *q)
         if (q->start_streaming_called)
                 call_void_qop(q, stop_streaming, q);
 
+        /*
+         * If you see this warning, then the driver isn't cleaning up properly
+         * in stop_streaming(). See the stop_streaming() documentation in
+         * videobuf2-core.h for more information how buffers should be returned
+         * to vb2 in stop_streaming().
+         */
         if (WARN_ON(atomic_read(&q->owned_by_drv_count))) {
                 for (i = 0; i < q->num_buffers; ++i)
                         if (q->bufs[i]->state == VB2_BUF_STATE_ACTIVE)
@@ -2272,6 +2290,7 @@ static int vb2_internal_streamoff(struct vb2_queue *q, enum v4l2_buf_type type)
          * their normal dequeued state.
          */
         __vb2_queue_cancel(q);
+        q->waiting_for_buffers = !V4L2_TYPE_IS_OUTPUT(q->type);
 
         dprintk(3, "successful\n");
         return 0;
@@ -2590,10 +2609,17 @@ unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
         }
 
         /*
-         * There is nothing to wait for if no buffer has been queued and the
-         * queue isn't streaming, or if the error flag is set.
+         * There is nothing to wait for if the queue isn't streaming, or if the
+         * error flag is set.
+         */
+        if (!vb2_is_streaming(q) || q->error)
+                return res | POLLERR;
+        /*
+         * For compatibility with vb1: if QBUF hasn't been called yet, then
+         * return POLLERR as well. This only affects capture queues, output
+         * queues will always initialize waiting_for_buffers to false.
          */
-        if ((list_empty(&q->queued_list) && !vb2_is_streaming(q)) || q->error)
+        if (q->waiting_for_buffers)
                 return res | POLLERR;
 
         /*