[PATCHv9 19/25] v4l: vb2: add buffer exporting via dmabuf

[Hans Verkuil]

On Tue October 2 2012 16:27:30 Tomasz Stanislawski wrote:
> This patch adds extension to videobuf2-core. It allow to export a mmap buffer
> as a file descriptor.
> 
> Signed-off-by: Tomasz Stanislawski <t.stanislaws at samsung.com>
> Signed-off-by: Kyungmin Park <kyungmin.park at samsung.com>
> Acked-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
> ---
>  drivers/media/video/videobuf2-core.c |   82 ++++++++++++++++++++++++++++++++++
>  include/media/videobuf2-core.h       |    4 ++
>  2 files changed, 86 insertions(+)
> 
> diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
> index 05da3b4..a97815b 100644
> --- a/drivers/media/video/videobuf2-core.c
> +++ b/drivers/media/video/videobuf2-core.c

<snip>

> @@ -2455,6 +2528,15 @@ int vb2_ioctl_streamoff(struct file *file, void *priv, enum v4l2_buf_type i)
>  }
>  EXPORT_SYMBOL_GPL(vb2_ioctl_streamoff);
>  
> +int vb2_ioctl_expbuf(struct file *file, void *priv, struct v4l2_exportbuffer *p)
> +{
> +	struct video_device *vdev = video_devdata(file);
> +
> +	/* No need to call vb2_queue_is_busy(), anyone can export buffers. */

After thinking about this some more I'm not so sure we should allow this.
Exporting a buffer also means that the memory can't be freed as long as the
exported filehandle remains open.

That means that it is possible to make a malicious application that exports
the buffers and never frees them, which can cause havoc. I think that only
the filehandle that called REQBUFS/CREATE_BUFS should be allowed to export
buffers.

What do you think?

Regards,

	Hans

> +	return vb2_expbuf(vdev->queue, p);
> +}
> +EXPORT_SYMBOL_GPL(vb2_ioctl_expbuf);
> +
>  /* v4l2_file_operations helpers */
>  
>  int vb2_fop_mmap(struct file *file, struct vm_area_struct *vma)