Le mercredi 11 mai 2016 à 13:27 -0300, Mauro Carvalho Chehab a écrit : > This patch causes a Kernel panic when called on a DVB driver. > > This reverts commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab.
Seems rather tricky, since this commit fixed a possible (user induced) buffer overflow according to Sakari comment. Would be nice to fix and resubmit. > > Cc: Sakari Ailus <[email protected]> > Cc: Hans Verkuil <[email protected]> > Cc: [email protected] > Fixes: 2c1f6951a8a8 ("[media] videobuf2-v4l2: Verify planes array in > buffer dequeueing") > Signed-off-by: Mauro Carvalho Chehab <[email protected]> > --- > drivers/media/v4l2-core/videobuf2-v4l2.c | 6 ------ > 1 file changed, 6 deletions(-) > > diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c > b/drivers/media/v4l2-core/videobuf2-v4l2.c > index 7f366f1b0377..0b1b8c7b6ce5 100644 > --- a/drivers/media/v4l2-core/videobuf2-v4l2.c > +++ b/drivers/media/v4l2-core/videobuf2-v4l2.c > @@ -74,11 +74,6 @@ static int __verify_planes_array(struct vb2_buffer > *vb, const struct v4l2_buffer > return 0; > } > > -static int __verify_planes_array_core(struct vb2_buffer *vb, const > void *pb) > -{ > - return __verify_planes_array(vb, pb); > -} > - > /** > * __verify_length() - Verify that the bytesused value for each > plane fits in > * the plane length and that the data offset doesn't exceed the > bytesused value. > @@ -442,7 +437,6 @@ static int __fill_vb2_buffer(struct vb2_buffer > *vb, > } > > static const struct vb2_buf_ops v4l2_buf_ops = { > - .verify_planes_array = __verify_planes_array_core, > .fill_user_buffer = __fill_v4l2_buffer, > .fill_vb2_buffer = __fill_vb2_buffer, > .copy_timestamp = __copy_timestamp, -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
