Skip to contentSkip to conversation

Patch "[media] videobuf2-core: Check user space planes array in dqbuf" has been added to the 4.5-stable tree

PATCH [email protected] 1 participant 1 message May 2, 2016

Subsystems (3)
Stable branch Media (V4L/DVB) VIDEOBUF2 framework
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

[media] videobuf2-core: Check user space planes array in dqbuf

to the 4.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
videobuf2-core-check-user-space-planes-array-in-dqbuf.patch
and it can be found in the queue-4.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From e7e0c3e26587749b62d17b9dd0532874186c77f7 Mon Sep 17 00:00:00 2001

From: Sakari Ailus <[email protected]>
Date: Sun, 3 Apr 2016 16:15:00 -0300
Subject: [media] videobuf2-core: Check user space planes array in dqbuf

From: Sakari Ailus <[email protected]>

commit e7e0c3e26587749b62d17b9dd0532874186c77f7 upstream.

The number of planes in videobuf2 is specific to a buffer. In order to verify that the planes array provided by the user is long enough, a new vb2_buf_op is required.

Call __verify_planes_array() when the dequeued buffer is known. Return an error to the caller if there was one, otherwise remove the buffer from the done list.

Signed-off-by Sakari Ailus <[email protected]>
Acked-by Hans Verkuil <[email protected]>
Signed-off-by Mauro Carvalho Chehab <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/media/v4l2-core/videobuf2-core.c |   10 +++++-----
 include/media/videobuf2-core.h           |    4 ++++
 2 files changed, 9 insertions(+), 5 deletions(-)
drivers/media/v4l2-core/videobuf2-core.c +5 -5
@@ -1643,7 +1643,7 @@ static int __vb2_wait_for_done_vb(struct
  * Will sleep if required for nonblocking == false.
  */
 static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
-				int nonblocking)
+			     void *pb, int nonblocking)
 {
 	unsigned long flags;
 	int ret;

@@ -1664,10 +1664,10 @@ static int __vb2_get_done_vb(struct vb2_
 	/*
 	 * Only remove the buffer from done_list if v4l2_buffer can handle all
 	 * the planes.
-	 * Verifying planes is NOT necessary since it already has been checked
-	 * before the buffer is queued/prepared. So it can never fail.
 	 */
-	list_del(&(*vb)->done_entry);
+	ret = call_bufop(q, verify_planes_array, *vb, pb);
+	if (!ret)
+		list_del(&(*vb)->done_entry);
 	spin_unlock_irqrestore(&q->done_lock, flags);
 
 	return ret;

@@ -1746,7 +1746,7 @@ int vb2_core_dqbuf(struct vb2_queue *q,
 	struct vb2_buffer *vb = NULL;
 	int ret;
 
-	ret = __vb2_get_done_vb(q, &vb, nonblocking);
+	ret = __vb2_get_done_vb(q, &vb, pb, nonblocking);
 	if (ret < 0)
 		return ret;
include/media/videobuf2-core.h +4 -0
@@ -375,6 +375,9 @@ struct vb2_ops {
 /**
  * struct vb2_ops - driver-specific callbacks
  *
+ * @verify_planes_array: Verify that a given user space structure contains
+ *			enough planes for the buffer. This is called
+ *			for each dequeued buffer.
  * @fill_user_buffer:	given a vb2_buffer fill in the userspace structure.
  *			For V4L2 this is a struct v4l2_buffer.
  * @fill_vb2_buffer:	given a userspace structure, fill in the vb2_buffer.

@@ -384,6 +387,7 @@ struct vb2_ops {
  *			the vb2_buffer struct.
  */
 struct vb2_buf_ops {
+	int (*verify_planes_array)(struct vb2_buffer *vb, const void *pb);
 	void (*fill_user_buffer)(struct vb2_buffer *vb, void *pb);
 	int (*fill_vb2_buffer)(struct vb2_buffer *vb, const void *pb,
 				struct vb2_plane *planes);

Patches currently in stable-queue which might be from [email protected] are

queue-4.5/videobuf2-v4l2-verify-planes-array-in-buffer-dequeueing.patch queue-4.5/videobuf2-core-check-user-space-planes-array-in-dqbuf.patch