drivers: speculative load before bound-check

[hercules2020/nv-tegra/linux-4.4.git] / drivers / media / v4l2-core / videobuf2-v4l2.c

diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c
index 502984c724ff5efd14ef10250dd5d8e653468111..461eba1270460bc12ae1cac7147b2bc258cf7289 100644 (file)
--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
@@ -32,6 +32,7 @@
 #include <media/videobuf2-v4l2.h>
 
 #include "videobuf2-internal.h"
+#include <asm/barrier.h>
 
 /* Flags that are set by the vb2 core */
 #define V4L2_BUFFER_MASK_FLAGS (V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
@@ -158,6 +159,8 @@ static int vb2_queue_or_prepare_buf(struct vb2_queue *q, struct v4l2_buffer *b,
                return -EINVAL;
        }
 
+       speculation_barrier();
+
        if (q->bufs[b->index] == NULL) {
                /* Should never happen */
                dprintk(1, "%s: buffer is NULL\n", opname);
@@ -464,6 +467,9 @@ int vb2_querybuf(struct vb2_queue *q, struct v4l2_buffer *b)
                dprintk(1, "buffer index out of range\n");
                return -EINVAL;
        }
+
+       speculation_barrier();
+
        vb = q->bufs[b->index];
        ret = __verify_planes_array(vb, b);