Commit 27afd6e0 authored by Marek Szyprowski's avatar Marek Szyprowski Committed by Hans Verkuil
Browse files

media: videobuf2: forbid remove_bufs when legacy fileio is active 



vb2_ioctl_remove_bufs() call manipulates queue internal buffer list,
potentially overwriting some pointers used by the legacy fileio access
mode. Forbid that ioctl when fileio is active to protect internal queue
state between subsequent read/write calls.

CC: stable@vger.kernel.org
Fixes: a3293a85 ("media: v4l2: Add REMOVE_BUFS ioctl")
Reported-by: default avatarShuangpeng Bai <SJB7183@psu.edu>
Closes: https://lore.kernel.org/linux-media/5317B590-AAB4-4F17-8EA1-621965886D49@psu.edu/


Signed-off-by: default avatarMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: default avatarHans Verkuil <hverkuil+cisco@kernel.org>
parent 758dbc75

drivers/media/common/videobuf2/videobuf2-v4l2.c

+5 −0
Original line number Diff line number Diff line
@@ -1010,6 +1010,11 @@ int vb2_ioctl_remove_bufs(struct file *file, void *priv, 
	if (vb2_queue_is_busy(vdev->queue, file))

		return -EBUSY;



	if (vb2_fileio_is_active(vdev->queue)) {

		dprintk(vdev->queue, 1, "file io in progress\n");

		return -EBUSY;

	}



	return vb2_core_remove_bufs(vdev->queue, d->index, d->count);

}

EXPORT_SYMBOL_GPL(vb2_ioctl_remove_bufs);