On Fri, Feb 13, 2015 at 09:42:37AM +0200, Sakari Ailus wrote: > The last argument of vb2_dc_get_user_pages() is of type enum > dma_data_direction, but the caller, vb2_dc_get_userptr() passes a value > which is the result of comparison dma_dir == DMA_FROM_DEVICE. This results > in the write parameter to get_user_pages() being zero in all cases, i.e. > that the caller has no intent to write there. > > This was broken by patch "vb2: replace 'write' by 'dma_dir'". > > Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx> Well, v3.19 is out so this is material for the stable branch. I'll submit a pull request once I get some acks. This is quite bad indeed, as writing somewhere you're not expected to write may well lead to memory corruption, which is exactly the case here. -- Sakari Ailus e-mail: sakari.ailus@xxxxxx XMPP: sailus@xxxxxxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
