media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
authorHans de Goede <hdegoede@redhat.com>
Mon, 1 Nov 2021 14:53:55 +0000 (14:53 +0000)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Wed, 10 Nov 2021 11:38:48 +0000 (11:38 +0000)
commitd55c3ee6b4c7b76326eb257403762f8bd7cc48c2
tree04b37741df5c33b43b727f77b43ad4e1a8386a67
parent678d92b6126b9f55419b6a51ef0a88bce2ef2f20
media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference

Commit a4b83deb3e76 ("media: videobuf2: rework vb2_mem_ops API")
added a new vb member to struct vb2_dma_sg_buf, but it only added
code setting this to the vb2_dma_sg_alloc() function and not to the
vb2_dma_sg_get_userptr() and vb2_dma_sg_attach_dmabuf() which also
create vb2_dma_sg_buf objects.

This is causing a crash due to a NULL pointer deref when using
libcamera on devices with an Intel IPU3 (qcam app).

Fix these crashes by assigning buf->vb in the other 2 functions too,
note libcamera tests the vb2_dma_sg_get_userptr() path, the change
to the vb2_dma_sg_attach_dmabuf() path is untested.

Fixes: a4b83deb3e76 ("media: videobuf2: rework vb2_mem_ops API")
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/common/videobuf2/videobuf2-dma-sg.c