Commit fa88dc7d authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

media: dvb-core: add missing buffer index check 



dvb_vb2_expbuf() didn't check if the given buffer index was
for a valid buffer. Add this check.

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: default avatarChenyuan Yang <chenyuan0y@gmail.com>
Closes: https://lore.kernel.org/linux-media/?q=WARNING+in+vb2_core_reqbufs


Fixes: 7dc866df ("media: dvb-core: Use vb2_get_buffer() instead of directly access to buffers array")
Reviewed-by: default avatarBenjamin Gaignard <benjamin.gaignard@collabora.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 9852d85e

drivers/media/dvb-core/dvb_vb2.c

+7 −1
Original line number Diff line number Diff line
@@ -366,9 +366,15 @@ int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b) 
int dvb_vb2_expbuf(struct dvb_vb2_ctx *ctx, struct dmx_exportbuffer *exp)

{

	struct vb2_queue *q = &ctx->vb_q;

	struct vb2_buffer *vb2 = vb2_get_buffer(q, exp->index);

	int ret;



	ret = vb2_core_expbuf(&ctx->vb_q, &exp->fd, q->type, q->bufs[exp->index],

	if (!vb2) {

		dprintk(1, "[%s] invalid buffer index\n", ctx->name);

		return -EINVAL;

	}



	ret = vb2_core_expbuf(&ctx->vb_q, &exp->fd, q->type, vb2,

			      0, exp->flags);

	if (ret) {

		dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,