Searched hist:d55c3ee6 (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/drivers/media/common/videobuf2/ |
H A D | videobuf2-dma-sg.c | d55c3ee6 Mon Nov 01 09:53:55 CDT 2021 Hans de Goede <hdegoede@redhat.com> media: videobuf2-dma-sg: Fix buf->vb NULL pointer dereference
Commit a4b83deb3e76 ("media: videobuf2: rework vb2_mem_ops API") added a new vb member to struct vb2_dma_sg_buf, but it only added code setting this to the vb2_dma_sg_alloc() function and not to the vb2_dma_sg_get_userptr() and vb2_dma_sg_attach_dmabuf() which also create vb2_dma_sg_buf objects.
This is causing a crash due to a NULL pointer deref when using libcamera on devices with an Intel IPU3 (qcam app).
Fix these crashes by assigning buf->vb in the other 2 functions too, note libcamera tests the vb2_dma_sg_get_userptr() path, the change to the vb2_dma_sg_attach_dmabuf() path is untested.
Fixes: a4b83deb3e76 ("media: videobuf2: rework vb2_mem_ops API") Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
|