media: v4l2-ctrls: v4l2_ctrl_request_complete() should always set ref->req

When the request is completed, all controls are copied to the request object.
However, when VIDIOC_G_EXT_CTRLS attempts to read control values from the
request it will read the current value instead for any control reference that
has a NULL ref->req pointer. But that's wrong: after completing the request
*all* controls should have a non-NULL ref->req pointer since they are after
all copied to the request.

So set ref->req if it wasn't set already.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index 2928c5e..93d33d1 100644 (file)
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -4296,10 +4296,17 @@ void v4l2_ctrl_request_complete(struct media_request *req,
                        continue;
 
                v4l2_ctrl_lock(ctrl);
-               if (ref->req)
+               if (ref->req) {
                        ptr_to_ptr(ctrl, ref->req->p_req, ref->p_req);
-               else
+               } else {
                        ptr_to_ptr(ctrl, ctrl->p_cur, ref->p_req);
+                       /*
+                        * Set ref->req to ensure that when userspace wants to
+                        * obtain the controls of this request it will take
+                        * this value and not the current value of the control.
+                        */
+                       ref->req = ref;
+               }
                v4l2_ctrl_unlock(ctrl);
        }