linux/include/media
Hans Verkuil fac710e45d [media] vb2: fix nasty vb2_thread regression
The vb2_thread implementation was made generic and was moved from
videobuf2-v4l2.c to videobuf2-core.c in commit af3bac1a. Unfortunately
that clearly was never tested since it broke read() causing NULL address
references.

The root cause was confused handling of vb2_buffer vs v4l2_buffer (the pb
pointer in various core functions).

The v4l2_buffer no longer exists after moving the code into the core and
it is no longer needed. However, the vb2_thread code passed a pointer to
a vb2_buffer to the core functions were a v4l2_buffer pointer was expected
and vb2_thread expected that the vb2_buffer fields would be filled in
correctly.

This is obviously wrong since v4l2_buffer != vb2_buffer. Note that the
pb pointer is a void pointer, so no type-checking took place.

This patch fixes this problem:

1) allow pb to be NULL for vb2_core_(d)qbuf. The vb2_thread code will use
   a NULL pointer here since they don't care about v4l2_buffer anyway.
2) let vb2_core_dqbuf pass back the index of the received buffer. This is
   all vb2_thread needs: this index is the index into the q->bufs array
   and vb2_thread just gets the vb2_buffer from there.
3) the fileio->b pointer (that originally contained a v4l2_buffer) is
   removed altogether since it is no longer needed.

Tested with vivid and the cobalt driver.

Cc: stable@vger.kernel.org # Kernel >= 4.3
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reported-by: Matthias Schwarzott <zzam@gentoo.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-02-04 09:13:46 -02:00
..
blackfin
davinci [media] media: videobuf2: Restructure vb2_buffer 2015-10-01 09:04:43 -03:00
drv-intf [media] media, sound: tea575x: constify snd_tea575x_ops structures 2015-12-03 11:26:45 -02:00
i2c [media] include/media: split I2C headers from V4L2 core 2015-11-17 06:57:11 -02:00
i2c-addr.h
lirc.h [media] bz#75751: Move internal header file lirc.h to uapi/ 2015-11-17 06:47:43 -02:00
lirc_dev.h [media] lirc_dev.h: Make checkpatch happy 2015-10-05 13:50:42 -03:00
media-device.h [media] media-device.h: use just one u32 counter for object ID 2016-01-11 12:19:23 -02:00
media-devnode.h [media] media-devnode.h: document the remaining struct/functions 2016-01-11 12:19:13 -02:00
media-entity.h [media] media-entitiy: add a function to create multiple links 2016-01-11 12:19:26 -02:00
rc-core.h [media] rc-core: define a default timeout for drivers 2015-11-19 06:50:59 -02:00
rc-map.h [media] media: rc: improve RC_BIT_ constant definition 2015-11-19 11:39:58 -02:00
soc_camera.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 2015-10-01 08:48:18 -03:00
tuner-types.h [media] DocBook: add documentation for tuner-types.h 2015-10-05 11:37:15 -03:00
tuner.h [media] tuner-core: add an input pad 2016-01-11 12:18:55 -02:00
tveeprom.h [media] DocBook: Document tveeprom.h 2015-10-05 13:49:02 -03:00
v4l2-async.h [media] Docbook: Fix comments at v4l2-async.h 2015-08-22 05:17:27 -03:00
v4l2-clk.h [media] v4l2-clk: add new definition: V4L2_CLK_NAME_SIZE 2015-11-17 15:19:11 -02:00
v4l2-common.h
v4l2-ctrls.h [media] v4l2-ctrls.h: Document a few missing arguments 2015-08-22 09:05:52 -03:00
v4l2-dev.h [media] v4l2-core: create MC interfaces for devnodes 2016-01-11 12:18:57 -02:00
v4l2-device.h
v4l2-dv-timings.h [media] v4l2-dv-timings: add new arg to v4l2_match_dv_timings 2015-12-03 11:26:14 -02:00
v4l2-event.h [media] v4l2-event.h: fix comments and add to DocBook 2015-08-22 09:05:52 -03:00
v4l2-fh.h
v4l2-flash-led-class.h [media] Docbook: fix comments at v4l2-flash-led-class.h 2015-08-22 05:28:44 -03:00
v4l2-image-sizes.h
v4l2-ioctl.h [media] v4l2: add support for SDR transmitter 2015-10-20 15:40:50 -02:00
v4l2-mediabus.h [media] v4l2-mediabus: Add to DocBook 2015-08-22 09:05:55 -03:00
v4l2-mem2mem.h [media] media: videobuf2: Restructure vb2_buffer 2015-10-01 09:04:43 -03:00
v4l2-of.h [media] v4l2-of: fix compiler errors if CONFIG_OF is undefined 2015-04-28 08:33:45 -03:00
v4l2-subdev.h [media] v4l2-subdev: add remaining argument descriptions 2015-08-22 07:00:26 -03:00
videobuf-core.h treewide: fix typos in comment blocks 2015-08-07 14:46:24 +02:00
videobuf-dma-contig.h
videobuf-dma-sg.h
videobuf-dvb.h
videobuf-vmalloc.h
videobuf2-core.h [media] vb2: fix nasty vb2_thread regression 2016-02-04 09:13:46 -02:00
videobuf2-dma-contig.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 2015-10-01 08:48:18 -03:00
videobuf2-dma-sg.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 2015-10-01 08:48:18 -03:00
videobuf2-dvb.h [media] media: videobuf2: Move v4l2-specific stuff to videobuf2-v4l2 2015-10-20 15:14:28 -02:00
videobuf2-memops.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 2015-10-01 08:48:18 -03:00
videobuf2-v4l2.h [media] media: videobuf2: Move vb2_fileio_data and vb2_thread to core part 2015-12-18 13:58:09 -02:00
videobuf2-vmalloc.h [media] media: videobuf2: Replace videobuf2-core with videobuf2-v4l2 2015-10-01 08:48:18 -03:00