[PATCH] media: videobuf2-core: Fix one __qbuf_dmabuf() error path

[PATCH] media: videobuf2-core: Fix one __qbuf_dmabuf() error path

[Wu, Xia]

Add dma_buf_put() to decrease refcount of the dmabuf in error path if DMABUF size is smaller than the requirement.

Signed-off-by: wu xia <xia.wu@intel.com>
---
 drivers/media/v4l2-core/videobuf2-core.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 33bdd81..1f232e7 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1084,6 +1084,7 @@ static int __qbuf_dmabuf(struct vb2_buffer *vb, const void *pb)
 		if (planes[plane].length < q->plane_sizes[plane]) {
 			dprintk(1, "invalid dmabuf length for plane %d\n",
 				plane);
+			dma_buf_put(dbuf);
 			ret = -EINVAL;
 			goto err;
 		}
--
1.7.9.5

Re: [PATCH] media: videobuf2-core: Fix one __qbuf_dmabuf() error path

[Sakari Ailus]

Hi Wu,

Wu, Xia wrote:
> Add dma_buf_put() to decrease refcount of the dmabuf in error path if DMABUF size is smaller than the requirement.
> 
> Signed-off-by: wu xia <xia.wu@intel.com>
> ---
>  drivers/media/v4l2-core/videobuf2-core.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
> index 33bdd81..1f232e7 100644
> --- a/drivers/media/v4l2-core/videobuf2-core.c
> +++ b/drivers/media/v4l2-core/videobuf2-core.c
> @@ -1084,6 +1084,7 @@ static int __qbuf_dmabuf(struct vb2_buffer *vb, const void *pb)
>  		if (planes[plane].length < q->plane_sizes[plane]) {
>  			dprintk(1, "invalid dmabuf length for plane %d\n",
>  				plane);
> +			dma_buf_put(dbuf);
>  			ret = -EINVAL;
>  			goto err;
>  		}

Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>

Looks like the bug has been also in the original implementation, and the
code has been in a bit of flux since, yet the bug has remained...

I think it'd be nice to have this in stable kernels. Mauro, Hans, what
do you think?

-- 
Kind regards,

Sakari Ailus
sakari.ailus@linux.intel.com

RE: [PATCH] media: videobuf2-core: Fix one __qbuf_dmabuf() error path

[Wu, Xia]

Hi, Sakari,
On Wed, Dec 09, 2015 at 4:26PM, Sakari wrote:

> Hi Wu,
> 
> Wu, Xia wrote:
> > Add dma_buf_put() to decrease refcount of the dmabuf in error path if
> DMABUF size is smaller than the requirement.
> >
> > Signed-off-by: wu xia <xia.wu@intel.com>
> > ---
> >  drivers/media/v4l2-core/videobuf2-core.c |    1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/media/v4l2-core/videobuf2-core.c
> > b/drivers/media/v4l2-core/videobuf2-core.c
> > index 33bdd81..1f232e7 100644
> > --- a/drivers/media/v4l2-core/videobuf2-core.c
> > +++ b/drivers/media/v4l2-core/videobuf2-core.c
> > @@ -1084,6 +1084,7 @@ static int __qbuf_dmabuf(struct vb2_buffer *vb,
> const void *pb)
> >  		if (planes[plane].length < q->plane_sizes[plane]) {
> >  			dprintk(1, "invalid dmabuf length for plane %d\n",
> >  				plane);
> > +			dma_buf_put(dbuf);
> >  			ret = -EINVAL;
> >  			goto err;
> >  		}
> 
> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> 
> Looks like the bug has been also in the original implementation, and the code
> has been in a bit of flux since, yet the bug has remained...
> 
> I think it'd be nice to have this in stable kernels. Mauro, Hans, what do you
> think?

Thank you for your feedback. Yes, it seems that the bug is there for a long time.
It's better to have this fix in stable kernels.

> 
> --
> Kind regards,
> 
> Sakari Ailus
> sakari.ailus@linux.intel.com