From: Marek Szyprowski Date: Wed, 16 Nov 2011 18:09:40 +0000 (-0300) Subject: [media] media: vb2: fix queueing of userptr buffers with null buffer pointer X-Git-Tag: upstream/snapshot3+hdmi~7520^2~479 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f0b7c7fc6f15e823cb4a5d225d9ef28b884ab6ec;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git [media] media: vb2: fix queueing of userptr buffers with null buffer pointer Heuristic that checks if the memory pointer has been changed lacked a check if the pointer was actually provided by the userspace, what allowed one to queue a NULL pointer which was accepted without further checking. This patch fixes this issue. Reported-by: Sylwester Nawrocki Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park CC: Pawel Osciak Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c index 95a3f5e..4d22b82 100644 --- a/drivers/media/video/videobuf2-core.c +++ b/drivers/media/video/videobuf2-core.c @@ -883,7 +883,8 @@ static int __qbuf_userptr(struct vb2_buffer *vb, const struct v4l2_buffer *b) for (plane = 0; plane < vb->num_planes; ++plane) { /* Skip the plane if already verified */ - if (vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr + if (vb->v4l2_planes[plane].m.userptr && + vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr && vb->v4l2_planes[plane].length == planes[plane].length) continue;