V4L/DVB (3704): Fix some errors on bttv_risc_overlay

There are tree mistakes on bttv_risc_overlay.
1) When skip_odd is true, the number of lines for which
instructions are written is (height+1)/2, not height/2.
2) This occurs when clipping: the number of instruction bytes
written can be as much as 8 + 12*nclips, not 8 + 8*nclips, as
currently estimated.
3) Coverity check were wrong with nskips=0, since it means that
it can clipped at most one line.

Signed-off-by: Duncan Sands <baldrick@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

diff --git a/drivers/media/video/bt8xx/bttv-risc.c b/drivers/media/video/bt8xx/bttv-risc.c
index 16323a5d68acc431095b14655d6a2c9aaf73dcea..afcfe71e37928ca7558a6dad33ef27dea609a0b4 100644 (file)
--- a/drivers/media/video/bt8xx/bttv-risc.c
+++ b/drivers/media/video/bt8xx/bttv-risc.c
@@ -233,7 +233,7 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
                  const struct bttv_format *fmt, struct bttv_overlay *ov,
                  int skip_even, int skip_odd)
 {
-       int instructions,rc,line,maxy,start,end,skip,nskips;
+       int dwords,rc,line,maxy,start,end,skip,nskips;
        struct btcx_skiplist *skips;
        u32 *rp,ri,ra;
        u32 addr;
@@ -242,12 +242,12 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
        if (NULL == (skips = kmalloc(sizeof(*skips) * ov->nclips,GFP_KERNEL)))
                return -ENOMEM;
 
-       /* estimate risc mem: worst case is (clip+1) * lines instructions
+       /* estimate risc mem: worst case is (1.5*clip+1) * lines instructions
           + sync + jump (all 2 dwords) */
-       instructions  = (ov->nclips + 1) *
-               ((skip_even || skip_odd) ? ov->w.height>>1 :  ov->w.height);
-       instructions += 2;
-       if ((rc = btcx_riscmem_alloc(btv->c.pci,risc,instructions*8)) < 0) {
+       dwords  = (3 * ov->nclips + 2) *
+               ((skip_even || skip_odd) ? (ov->w.height+1)>>1 :  ov->w.height);
+       dwords += 4;
+       if ((rc = btcx_riscmem_alloc(btv->c.pci,risc,dwords*4)) < 0) {
                kfree(skips);
                return rc;
        }
@@ -276,8 +276,6 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
                if (line > maxy)
                        btcx_calc_skips(line, ov->w.width, &maxy,
                                        skips, &nskips, ov->clips, ov->nclips);
-               else
-                       nskips = 0;
 
                /* write out risc code */
                for (start = 0, skip = 0; start < ov->w.width; start = end) {