From 4b971606c7ef3e85be57b31d2583e169f983d91f Mon Sep 17 00:00:00 2001
From: Vladimir Barinov <vladimir.barinov@cogentembedded.com>
Date: Mon, 31 Jul 2017 19:26:05 +0300
Subject: [PATCH] media: soc_camera: Fix VIDIOC_S_SELECTION ioctl
 miscalculation

This patch corrects the miscalculation of the capture buffer
size and clipping data update in VIDIOC_S_SELECTION sequence.

Patch isbased on work by: Koji Matsuoka <koji.matsuoka.xm@renesas.com>

Signed-off-by: Vladimir Barinov <vladimir.barinov@cogentembedded.com>
---
 drivers/media/platform/soc_camera/soc_scale_crop.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/soc_camera/soc_scale_crop.c b/drivers/media/platform/soc_camera/soc_scale_crop.c
index f77252d..79a7d95 100644
--- a/drivers/media/platform/soc_camera/soc_scale_crop.c
+++ b/drivers/media/platform/soc_camera/soc_scale_crop.c
@@ -72,14 +72,14 @@ static void update_subrect(struct v4l2_rect *rect, struct v4l2_rect *subrect)
 
 	if (rect->left > subrect->left)
 		subrect->left = rect->left;
-	else if (rect->left + rect->width >
+	else if (rect->left + rect->width <
 		 subrect->left + subrect->width)
 		subrect->left = rect->left + rect->width -
 			subrect->width;
 
 	if (rect->top > subrect->top)
 		subrect->top = rect->top;
-	else if (rect->top + rect->height >
+	else if (rect->top + rect->height <
 		 subrect->top + subrect->height)
 		subrect->top = rect->top + rect->height -
 			subrect->height;
@@ -125,6 +125,7 @@ int soc_camera_client_s_selection(struct v4l2_subdev *sd,
 		dev_dbg(dev, "Camera S_SELECTION successful for %dx%d@%d:%d\n",
 			rect->width, rect->height, rect->left, rect->top);
 		*target_rect = *cam_rect;
+		*subrect = *rect;
 		return 0;
 	}
 
@@ -216,6 +217,7 @@ int soc_camera_client_s_selection(struct v4l2_subdev *sd,
 
 	if (!ret) {
 		*target_rect = *cam_rect;
+		*subrect = *rect;
 		update_subrect(target_rect, subrect);
 	}
 
@@ -296,9 +298,7 @@ static int client_set_fmt(struct soc_camera_device *icd,
 	if (ret < 0)
 		return ret;
 
-	if (host_1to1)
-		*subrect = *rect;
-	else
+	if (!host_1to1)
 		update_subrect(rect, subrect);
 
 	return 0;
-- 
1.9.1

