update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/media/dvb-core/dvb_vb2.c
..
..
@@ -146,8 +146,7 @@
146
146
 	dprintk(3, "[%s]\n", ctx->name);
147
147
 }
148
148
 
149
-static int _fill_vb2_buffer(struct vb2_buffer *vb,
150
-			    const void *pb, struct vb2_plane *planes)
149
+static int _fill_vb2_buffer(struct vb2_buffer *vb, struct vb2_plane *planes)
151
150
 {
152
151
 	struct dvb_vb2_ctx *ctx = vb2_get_drv_priv(vb->vb2_queue);
153
152
 
..
..
@@ -194,7 +193,7 @@
194
193
 	spin_lock_init(&ctx->slock);
195
194
 	INIT_LIST_HEAD(&ctx->dvb_q);
196
195
 
197
-	strlcpy(ctx->name, name, DVB_VB2_NAME_MAX);
196
+	strscpy(ctx->name, name, DVB_VB2_NAME_MAX);
198
197
 	ctx->nonblocking = nonblocking;
199
198
 	ctx->state = DVB_VB2_STATE_INIT;
200
199
 
..
..
@@ -359,6 +358,12 @@
359
358
 
360
359
 int dvb_vb2_querybuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
361
360
 {
361
+	struct vb2_queue *q = &ctx->vb_q;
362
+
363
+	if (b->index >= q->num_buffers) {
364
+		dprintk(1, "[%s] buffer index out of range\n", ctx->name);
365
+		return -EINVAL;
366
+	}
362
367
 	vb2_core_querybuf(&ctx->vb_q, b->index, b);
363
368
 	dprintk(3, "[%s] index=%d\n", ctx->name, b->index);
364
369
 	return 0;
..
..
@@ -383,9 +388,14 @@
383
388
 
384
389
 int dvb_vb2_qbuf(struct dvb_vb2_ctx *ctx, struct dmx_buffer *b)
385
390
 {
391
+	struct vb2_queue *q = &ctx->vb_q;
386
392
 	int ret;
387
393
 
388
-	ret = vb2_core_qbuf(&ctx->vb_q, b->index, b);
394
+	if (b->index >= q->num_buffers) {
395
+		dprintk(1, "[%s] buffer index out of range\n", ctx->name);
396
+		return -EINVAL;
397
+	}
398
+	ret = vb2_core_qbuf(&ctx->vb_q, b->index, b, NULL);
389
399
 	if (ret) {
390
400
 		dprintk(1, "[%s] index=%d errno=%d\n", ctx->name,
391
401
 			b->index, ret);