- make saa7146_pgtable_build_single() deliver a return code, make some

  sanity checks of the arguments (if a bad pagetable is created,
  unpredictable thinks can happen. trust me... ;-)
- follow this change for the several uses

4 files changed, 16 insertions, 6 deletions

diff --git a/linux/drivers/media/common/saa7146_core.c b/linux/drivers/media/common/saa7146_core.c
index 452137925..84c6beb92 100644
--- a/linux/drivers/media/common/saa7146_core.c
+++ b/linux/drivers/media/common/saa7146_core.c
@@ -103,7 +103,9 @@ char *saa7146_vmalloc_build_pgtable(struct pci_dev *pci, long length, struct saa
 	}
 	
 	slen = pci_map_sg(pci,slist,pages,PCI_DMA_FROMDEVICE);
-	saa7146_pgtable_build_single(pci, pt, slist, slen);
+	if (0 != saa7146_pgtable_build_single(pci, pt, slist, slen)) {
+		return NULL;
+	}
 
 	/* fixme: here's a memory leak: slist never gets freed by any other
 	   function ...*/
@@ -139,7 +141,7 @@ int saa7146_pgtable_alloc(struct pci_dev *pci, struct saa7146_pgtable *pt)
 	return 0;
 }
 
-void saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt,
+int saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt,
 	struct scatterlist *list, int sglen  )
 {
 	u32 *ptr, fill;
@@ -147,7 +149,12 @@ void saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *p
 	int i,p;
 
 	BUG_ON( 0 == sglen);
-
+	
+	if (list->offset > PAGE_SIZE) {
+		DEB_D(("offset > PAGE_SIZE. this should not happen."));
+		return -EINVAL;
+	}
+	
 	/* if we have a user buffer, the first page may not be
 	   aligned to a page boundary. */
 	pt->offset = list->offset;
@@ -177,6 +184,7 @@ void saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *p
 		printk("ptr1 %d: 0x%08x\n",i,ptr[i]);
 	}
 */
+	return 0;
 }
 
 /********************************************************************************/
diff --git a/linux/drivers/media/common/saa7146_vbi.c b/linux/drivers/media/common/saa7146_vbi.c
index ee8c974d4..28266dc7d 100644
--- a/linux/drivers/media/common/saa7146_vbi.c
+++ b/linux/drivers/media/common/saa7146_vbi.c
@@ -249,7 +249,9 @@ static int buffer_prepare(struct file *file, struct videobuf_buffer *vb,enum v4l
 		err = videobuf_iolock(dev->pci,&buf->vb, NULL);
 		if (err)
 			goto oops;
-		saa7146_pgtable_build_single(dev->pci, &buf->pt[2], buf->vb.dma.sglist, buf->vb.dma.sglen);
+		err = saa7146_pgtable_build_single(dev->pci, &buf->pt[2], buf->vb.dma.sglist, buf->vb.dma.sglen);
+		if (0 != err)
+			return err;
 	}
 	buf->vb.state = STATE_PREPARED;
 	buf->activate = buffer_activate;
diff --git a/linux/drivers/media/common/saa7146_video.c b/linux/drivers/media/common/saa7146_video.c
index 569ad66c7..c0f805907 100644
--- a/linux/drivers/media/common/saa7146_video.c
+++ b/linux/drivers/media/common/saa7146_video.c
@@ -661,7 +661,7 @@ static int saa7146_pgtable_build(struct saa7146_dev *dev, struct saa7146_buf *bu
 */				
 	} else {
 		struct saa7146_pgtable *pt = &buf->pt[0];
-		saa7146_pgtable_build_single(pci, pt, list, length);
+		return saa7146_pgtable_build_single(pci, pt, list, length);
 	}
 
 	return 0;
diff --git a/linux/include/media/saa7146.h b/linux/include/media/saa7146.h
index 0404116f9..24e392cc3 100644
--- a/linux/include/media/saa7146.h
+++ b/linux/include/media/saa7146.h
@@ -162,7 +162,7 @@ int saa7146_unregister_extension(struct saa7146_extension*);
 struct saa7146_format* format_by_fourcc(struct saa7146_dev *dev, int fourcc);
 int saa7146_pgtable_alloc(struct pci_dev *pci, struct saa7146_pgtable *pt);
 void saa7146_pgtable_free(struct pci_dev *pci, struct saa7146_pgtable *pt);
-void saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt, struct scatterlist *list, int length );
+int saa7146_pgtable_build_single(struct pci_dev *pci, struct saa7146_pgtable *pt, struct scatterlist *list, int length );
 char *saa7146_vmalloc_build_pgtable(struct pci_dev *pci, long length, struct saa7146_pgtable *pt);
 void saa7146_setgpio(struct saa7146_dev *dev, int port, u32 data);