[media] media: vb2: fix queueing of userptr buffers with null buffer pointer

Heuristic that checks if the memory pointer has been changed lacked a check
if the pointer was actually provided by the userspace, what allowed one to
queue a NULL pointer which was accepted without further checking. This
patch fixes this issue.

Reported-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
CC: Pawel Osciak <pawel@osciak.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 95a3f5e82aef14c74a81045baa26874eb008e7c1..4d22b8214f98a16125de31673e9b6b790de79a67 100644 (file)
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -883,7 +883,8 @@ static int __qbuf_userptr(struct vb2_buffer *vb, const struct v4l2_buffer *b)
 
        for (plane = 0; plane < vb->num_planes; ++plane) {
                /* Skip the plane if already verified */
-               if (vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
+               if (vb->v4l2_planes[plane].m.userptr &&
+                   vb->v4l2_planes[plane].m.userptr == planes[plane].m.userptr
                    && vb->v4l2_planes[plane].length == planes[plane].length)
                        continue;