Hi Marek,
On Wednesday 16 November 2011 20:22:28 Marek Szyprowski wrote:
> Heuristic that checks if the memory pointer has been changed lacked a check
> if the pointer was actually provided by the userspace, what allowed one to
> queue a NULL pointer which was accepted without further checking.
Is that an issue ? If the pointer is NULL get_user_pages() will fail, won't it
?
> This patch fixes this issue.
>
> Reported-by: Sylwester Nawrocki <s.nawrocki@xxxxxxxxxxx>
> Signed-off-by: Marek Szyprowski <m.szyprowski@xxxxxxxxxxx>
> Signed-off-by: Kyungmin Park <kyungmin.park@xxxxxxxxxxx>
> CC: Pawel Osciak <pawel@xxxxxxxxxx>
> ---
> drivers/media/video/videobuf2-core.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/media/video/videobuf2-core.c
> b/drivers/media/video/videobuf2-core.c index ec49fed..24f11ae 100644
> --- a/drivers/media/video/videobuf2-core.c
> +++ b/drivers/media/video/videobuf2-core.c
> @@ -765,7 +765,8 @@ static int __qbuf_userptr(struct vb2_buffer *vb, struct
> v4l2_buffer *b)
>
> for (plane = 0; plane < vb->num_planes; ++plane) {
> /* Skip the plane if already verified */
> - if (vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
> + if (vb->v4l2_planes[plane].m.userptr &&
> + vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
> && vb->v4l2_planes[plane].length == planes[plane].length)
> continue;
--
Regards,
Laurent Pinchart
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
