media: videobuf2-core: copy vb planes unconditionally

Copy the relevant data from userspace to the vb->planes unconditionally
as it's possible some of the fields may have changed after the buffer
has been validated.

Keep the dma_buf_put(planes[plane].dbuf) calls in the first
`if (!reacquired)` case, in order to be close to the plane validation code
where the buffers were got in the first place.

Cc: stable@vger.kernel.org
Fixes: 95af7c00f35b ("media: videobuf2-core: release all planes first in __prepare_dmabuf()")
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Tested-by: Will McVicker <willmcvicker@google.com>
Acked-by: Tomasz Figa <tfiga@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 29a8d876e6c2819ea9b2aaedee73889ecd79fcb2..b0523fc23506acb23dffc00e73fc3f61d001d62b 100644 (file)
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -1482,18 +1482,23 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)
                        }
                        vb->planes[plane].dbuf_mapped = 1;
                }
+       } else {
+               for (plane = 0; plane < vb->num_planes; ++plane)
+                       dma_buf_put(planes[plane].dbuf);
+       }
 
-               /*
-                * Now that everything is in order, copy relevant information
-                * provided by userspace.
-                */
-               for (plane = 0; plane < vb->num_planes; ++plane) {
-                       vb->planes[plane].bytesused = planes[plane].bytesused;
-                       vb->planes[plane].length = planes[plane].length;
-                       vb->planes[plane].m.fd = planes[plane].m.fd;
-                       vb->planes[plane].data_offset = planes[plane].data_offset;
-               }
+       /*
+        * Now that everything is in order, copy relevant information
+        * provided by userspace.
+        */
+       for (plane = 0; plane < vb->num_planes; ++plane) {
+               vb->planes[plane].bytesused = planes[plane].bytesused;
+               vb->planes[plane].length = planes[plane].length;
+               vb->planes[plane].m.fd = planes[plane].m.fd;
+               vb->planes[plane].data_offset = planes[plane].data_offset;
+       }
 
+       if (reacquired) {
                /*
                 * Call driver-specific initialization on the newly acquired buffer,
                 * if provided.
@@ -1503,9 +1508,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb)
                        dprintk(q, 1, "buffer initialization failed\n");
                        goto err_put_vb2_buf;
                }
-       } else {
-               for (plane = 0; plane < vb->num_planes; ++plane)
-                       dma_buf_put(planes[plane].dbuf);
        }
 
        ret = call_vb_qop(vb, buf_prepare, vb);