mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
Commita4b83deb3e
("media: videobuf2: rework vb2_mem_ops API") added a new vb member to struct vb2_dma_sg_buf, but it only added code setting this to the vb2_dma_sg_alloc() function and not to the vb2_dma_sg_get_userptr() and vb2_dma_sg_attach_dmabuf() which also create vb2_dma_sg_buf objects. This is causing a crash due to a NULL pointer deref when using libcamera on devices with an Intel IPU3 (qcam app). Fix these crashes by assigning buf->vb in the other 2 functions too, note libcamera tests the vb2_dma_sg_get_userptr() path, the change to the vb2_dma_sg_attach_dmabuf() path is untested. Fixes:a4b83deb3e
("media: videobuf2: rework vb2_mem_ops API") Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
parent
678d92b612
commit
d55c3ee6b4
1 changed files with 2 additions and 0 deletions
|
@ -241,6 +241,7 @@ static void *vb2_dma_sg_get_userptr(struct vb2_buffer *vb, struct device *dev,
|
|||
buf->offset = vaddr & ~PAGE_MASK;
|
||||
buf->size = size;
|
||||
buf->dma_sgt = &buf->sg_table;
|
||||
buf->vb = vb;
|
||||
vec = vb2_create_framevec(vaddr, size);
|
||||
if (IS_ERR(vec))
|
||||
goto userptr_fail_pfnvec;
|
||||
|
@ -642,6 +643,7 @@ static void *vb2_dma_sg_attach_dmabuf(struct vb2_buffer *vb, struct device *dev,
|
|||
buf->dma_dir = vb->vb2_queue->dma_dir;
|
||||
buf->size = size;
|
||||
buf->db_attach = dba;
|
||||
buf->vb = vb;
|
||||
|
||||
return buf;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue