[PATCH] media: chips-media: wave5: Account for sizeimage 0 case

[Brandon Brnich]

V4L2 uAPI states that sizeimage can be set to 0 in struct
v4l2_pix_format_mplane if client wants the driver to configure a proper
sizeimage. If client leaves this field unset and configures an encode with
high bitrate, low QP, or any other parameters resulting in high quality
encode, then the driver-calculated bitstream buffer size (MIN_BS_SIZE) will
be too small resulting in undetermined behavior.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 88ff31fd0181 ("media: chips-media: wave5: Use helpers to calculate bytesperline and sizeimage.")
Signed-off-by: Brandon Brnich <b-brnich@xxxxxx>
---

Current DEFAULT_BS_SIZE is just a placeholder value - I can lower if
required so memory consumption doesn't go up drastically if sizeimage is
set 0 by user. I saw this was the common equation in rockchip and hantro
driver.

Link to uAPI requirement: https://docs.kernel.org/userspace-api/media/v4l/pixfmt-v4l2-mplane.html

 .../media/platform/chips-media/wave5/wave5-helper.c  | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-helper.c b/drivers/media/platform/chips-media/wave5/wave5-helper.c
index c3d34be833ff0..384a0a9aac3ae 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-helper.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-helper.c
@@ -7,7 +7,10 @@
 
 #include "wave5-helper.h"
 
-#define DEFAULT_BS_SIZE(width, height) ((width) * (height) / 8 * 3)
+/* Smallest bitstream buffer accepted when the client provides a sizeimage */
+#define MIN_BS_SIZE(width, height) ((width) * (height) * 3 / 8)
+/* Worst case: Allocate bitstream buffer size based on resolution and max depth */
+#define DEFAULT_BS_SIZE(width, height) ((width) * (height) * 2)
 
 const char *state_to_str(enum vpu_instance_state state)
 {
@@ -261,8 +264,11 @@ void wave5_update_pix_fmt(struct v4l2_pix_format_mplane *pix_mp,
 		pix_mp->height = height;
 		pix_mp->num_planes = 1;
 		pix_mp->plane_fmt[0].bytesperline = 0;
-		pix_mp->plane_fmt[0].sizeimage = max(DEFAULT_BS_SIZE(width, height),
-						     pix_mp->plane_fmt[0].sizeimage);
+		if (!pix_mp->plane_fmt[0].sizeimage)
+			pix_mp->plane_fmt[0].sizeimage = DEFAULT_BS_SIZE(width, height);
+		else
+			pix_mp->plane_fmt[0].sizeimage = max(MIN_BS_SIZE(width, height),
+							     pix_mp->plane_fmt[0].sizeimage);
 	} else {
 		v4l2_fill_pixfmt_mp(pix_mp, pix_mp->pixelformat, width, height);
 	}
-- 
2.43.0