Commit 702a47ce authored by Tudor Ambarus's avatar Tudor Ambarus Committed by Hans Verkuil
Browse files

media: videobuf2-core: copy vb planes unconditionally 



Copy the relevant data from userspace to the vb->planes unconditionally
as it's possible some of the fields may have changed after the buffer
has been validated.

Keep the dma_buf_put(planes[plane].dbuf) calls in the first
`if (!reacquired)` case, in order to be close to the plane validation code
where the buffers were got in the first place.

Cc: stable@vger.kernel.org
Fixes: 95af7c00 ("media: videobuf2-core: release all planes first in __prepare_dmabuf()")
Signed-off-by: default avatarTudor Ambarus <tudor.ambarus@linaro.org>
Tested-by: default avatarWill McVicker <willmcvicker@google.com>
Acked-by: default avatarTomasz Figa <tfiga@chromium.org>
Signed-off-by: default avatarHans Verkuil <hverkuil@xs4all.nl>
parent a4aebaf6

drivers/media/common/videobuf2/videobuf2-core.c

+15 −13
Original line number Diff line number Diff line
@@ -1482,6 +1482,10 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) 
			}

			vb->planes[plane].dbuf_mapped = 1;

		}

	} else {

		for (plane = 0; plane < vb->num_planes; ++plane)

			dma_buf_put(planes[plane].dbuf);

	}



	/*

	 * Now that everything is in order, copy relevant information
@@ -1494,6 +1498,7 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) 
		vb->planes[plane].data_offset = planes[plane].data_offset;

	}



	if (reacquired) {

		/*

		 * Call driver-specific initialization on the newly acquired buffer,

		 * if provided.
@@ -1503,9 +1508,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) 
			dprintk(q, 1, "buffer initialization failed\n");

			goto err_put_vb2_buf;

		}

	} else {

		for (plane = 0; plane < vb->num_planes; ++plane)

			dma_buf_put(planes[plane].dbuf);

	}



	ret = call_vb_qop(vb, buf_prepare, vb);