Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7e0c3e2 authored by Sakari Ailus's avatar Sakari Ailus Committed by Mauro Carvalho Chehab
Browse files

[media] videobuf2-core: Check user space planes array in dqbuf 



The number of planes in videobuf2 is specific to a buffer. In order to
verify that the planes array provided by the user is long enough, a new
vb2_buf_op is required.

Call __verify_planes_array() when the dequeued buffer is known. Return an
error to the caller if there was one, otherwise remove the buffer from the
done list.

Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org # for v4.4 and later
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 405ddbfa

drivers/media/v4l2-core/videobuf2-core.c

+5 −5
Original line number Diff line number Diff line
@@ -1645,7 +1645,7 @@ static int __vb2_wait_for_done_vb(struct vb2_queue *q, int nonblocking) 
 * Will sleep if required for nonblocking == false.

 */

static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,

				int nonblocking)

			     void *pb, int nonblocking)

{

	unsigned long flags;

	int ret;
@@ -1666,9 +1666,9 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb, 
	/*

	 * Only remove the buffer from done_list if v4l2_buffer can handle all

	 * the planes.

	 * Verifying planes is NOT necessary since it already has been checked

	 * before the buffer is queued/prepared. So it can never fail.

	 */

	ret = call_bufop(q, verify_planes_array, *vb, pb);

	if (!ret)

		list_del(&(*vb)->done_entry);

	spin_unlock_irqrestore(&q->done_lock, flags);
@@ -1748,7 +1748,7 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb, 
	struct vb2_buffer *vb = NULL;

	int ret;



	ret = __vb2_get_done_vb(q, &vb, nonblocking);

	ret = __vb2_get_done_vb(q, &vb, pb, nonblocking);

	if (ret < 0)

		return ret;

include/media/videobuf2-core.h

+4 −0
Original line number Diff line number Diff line
@@ -375,6 +375,9 @@ struct vb2_ops { 
/**

 * struct vb2_ops - driver-specific callbacks

 *

 * @verify_planes_array: Verify that a given user space structure contains

 *			enough planes for the buffer. This is called

 *			for each dequeued buffer.

 * @fill_user_buffer:	given a vb2_buffer fill in the userspace structure.

 *			For V4L2 this is a struct v4l2_buffer.

 * @fill_vb2_buffer:	given a userspace structure, fill in the vb2_buffer.
@@ -384,6 +387,7 @@ struct vb2_ops { 
 *			the vb2_buffer struct.

 */

struct vb2_buf_ops {

	int (*verify_planes_array)(struct vb2_buffer *vb, const void *pb);

	void (*fill_user_buffer)(struct vb2_buffer *vb, void *pb);

	int (*fill_vb2_buffer)(struct vb2_buffer *vb, const void *pb,

				struct vb2_plane *planes);