[PATCH 5.4 0/1] media: v4l2-mem2mem: backport fix for CVE-2022-20369

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Backport summary:
-----------------
The return logic in v4l2_m2m_qbuf() was adjusted manually so that it matches
the logic in the original commit (v4l2_m2m_adjust_mem_offset() being called
only if !ret and before the v4l2_m2m_try_schedule() call):

@@ -500,10 +510,16 @@ int v4l2_m2m_qbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
 		return -EPERM;
 	}
 	ret = vb2_qbuf(vq, vdev->v4l2_dev->mdev, buf);
-	if (!ret && !(buf->flags & V4L2_BUF_FLAG_IN_REQUEST))
+	if (ret)
+		return ret;
+
+	/* Adjust MMAP memory offsets for the CAPTURE queue */
+	v4l2_m2m_adjust_mem_offset(vq, buf);
+
+	if (!(buf->flags & V4L2_BUF_FLAG_IN_REQUEST))
 		v4l2_m2m_try_schedule(m2m_ctx);
 
-	return ret;
+	return 0;
 }
 EXPORT_SYMBOL_GPL(v4l2_m2m_qbuf);

Build tested only.

Chen-Yu Tsai (1):
  media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across
    ioctls

 drivers/media/v4l2-core/v4l2-mem2mem.c | 60 ++++++++++++++++++++------
 1 file changed, 46 insertions(+), 14 deletions(-)

-- 
2.37.1




[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux