2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-27 06:34:11 +08:00
linux-next/drivers/media
Ricardo Ribalda 89a0956683 [media] vb2-memops: Fix over allocation of frame vectors
On page unaligned frames, create_framevec forces get_vaddr_frames to
allocate an extra page at the end of the buffer. Under some
circumstances, this leads to -EINVAL on VIDIOC_QBUF.

E.g:
We have vm_a that vm_area that goes from 0x1000 to 0x3000. And a
frame that goes from 0x1800 to 0x2800, i.e. 2 pages.

frame_vector_create will be called with the following params:

get_vaddr_frames(0x1800, 2, write, 1, vec);

get_vaddr will allocate the first page after checking that the memory
0x1800-0x27ff is valid, but it will not allocate the second page because
the range 0x2800-0x37ff is out of the vm_a range. This results in
create_framevec returning -EFAULT

Error Trace:
[ 9083.793015] video0: VIDIOC_QBUF: 00:00:00.00000000 index=1,
type=vid-cap, flags=0x00002002, field=any, sequence=0,
memory=userptr, bytesused=0, offset/userptr=0x7ff2b023ca80, length=5765760
[ 9083.793028] timecode=00:00:00 type=0, flags=0x00000000,
frames=0, userbits=0x00000000
[ 9083.793117] video0: VIDIOC_QBUF: error -22: 00:00:00.00000000
index=2, type=vid-cap, flags=0x00000000, field=any, sequence=0,
memory=userptr, bytesused=0, offset/userptr=0x7ff2b07bc500, length=5765760

Also use true instead of 1 since that argument is a bool in the
get_vaddr_frames() prototype.

Fixes: 21fb0cb7ec ("[media] vb2: Provide helpers for mapping virtual addresses")

Reported-by: Albert Antony <albert@newtec.dk>
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
[hans.verkuil@cisco.com: merged the 'bool' change into this patch]
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>      # for v4.3 and up
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-04-25 10:22:55 -03:00
..
common [media] siano: firmware buffer is too small 2016-02-16 09:29:13 -02:00
dvb-core [media] dvb-core: fix return code checking for devices with CA 2016-03-03 14:33:33 -03:00
dvb-frontends [media] cx24120: make sure tuner is locked at get_frontend 2016-03-03 14:26:55 -03:00
firewire [media] dvb: modify core to implement interfaces/entities at MC new gen 2016-01-11 12:18:52 -02:00
i2c [media] adv7604: fix SPA register location for ADV7612 2016-03-03 07:32:20 -03:00
mmc [media] siano: register media controller earlier 2015-02-26 09:10:39 -03:00
pci Merge branch 'mm-pkeys-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-20 19:08:56 -07:00
platform [media] vsp1: use proper dma alloc/free functions 2016-03-21 13:49:01 -07:00
radio [media] tea575x: convert to library 2016-02-10 09:34:28 -02:00
rc [media] mceusb: use %*ph for small buffer dumps 2016-03-10 13:37:44 -03:00
tuners [media] xc4000: shut up a bogus smatch message 2016-02-23 07:14:02 -03:00
usb [media] usbvision: revert commit 588afcc1 2016-04-20 15:58:54 -03:00
v4l2-core [media] vb2-memops: Fix over allocation of frame vectors 2016-04-25 10:22:55 -03:00
Kconfig [media] Kconfig: Re-enable Media controller support for DVB 2016-01-11 12:18:40 -02:00
Makefile [media] bq/c-qcam, w9966, pms: move to staging in preparation for removal 2014-12-16 23:21:44 -02:00
media-device.c Merge commit '840f5b0572ea' into v4l_for_linus 2016-03-15 07:48:28 -03:00
media-devnode.c [media] media: Fix media_open() to clear filp->private_data in error leg 2016-02-01 13:21:33 -02:00
media-entity.c [media] media: add prefixes to interface types 2016-03-05 09:03:16 -03:00