lkml.org 
[lkml]   [2018]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 249/254] media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
    3.16.55-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Hans Verkuil <hans.verkuil@cisco.com>

    commit a751be5b142ef6bcbbb96d9899516f4d9c8d0ef4 upstream.

    put_v4l2_window32() didn't copy back the clip list to userspace.
    Drivers can update the clip rectangles, so this should be done.

    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 59 ++++++++++++++++++---------
    1 file changed, 40 insertions(+), 19 deletions(-)

    --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    @@ -50,6 +50,11 @@ struct v4l2_window32 {

    static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
    {
    + struct v4l2_clip32 __user *uclips;
    + struct v4l2_clip __user *kclips;
    + compat_caddr_t p;
    + u32 n;
    +
    if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
    copy_from_user(&kp->w, &up->w, sizeof(up->w)) ||
    get_user(kp->field, &up->field) ||
    @@ -59,38 +64,54 @@ static int get_v4l2_window32(struct v4l2
    return -EFAULT;
    if (kp->clipcount > 2048)
    return -EINVAL;
    - if (kp->clipcount) {
    - struct v4l2_clip32 __user *uclips;
    - struct v4l2_clip __user *kclips;
    - int n = kp->clipcount;
    - compat_caddr_t p;
    + if (!kp->clipcount) {
    + kp->clips = NULL;
    + return 0;
    + }

    - if (get_user(p, &up->clips))
    + n = kp->clipcount;
    + if (get_user(p, &up->clips))
    + return -EFAULT;
    + uclips = compat_ptr(p);
    + kclips = compat_alloc_user_space(n * sizeof(*kclips));
    + kp->clips = kclips;
    + while (n--) {
    + if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
    return -EFAULT;
    - uclips = compat_ptr(p);
    - kclips = compat_alloc_user_space(n * sizeof(*kclips));
    - kp->clips = kclips;
    - while (--n >= 0) {
    - if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
    - return -EFAULT;
    - if (put_user(n ? kclips + 1 : NULL, &kclips->next))
    - return -EFAULT;
    - uclips += 1;
    - kclips += 1;
    - }
    - } else
    - kp->clips = NULL;
    + if (put_user(n ? kclips + 1 : NULL, &kclips->next))
    + return -EFAULT;
    + uclips++;
    + kclips++;
    + }
    return 0;
    }

    static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
    {
    + struct v4l2_clip __user *kclips = kp->clips;
    + struct v4l2_clip32 __user *uclips;
    + u32 n = kp->clipcount;
    + compat_caddr_t p;
    +
    if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) ||
    put_user(kp->field, &up->field) ||
    put_user(kp->chromakey, &up->chromakey) ||
    put_user(kp->clipcount, &up->clipcount) ||
    put_user(kp->global_alpha, &up->global_alpha))
    return -EFAULT;
    +
    + if (!kp->clipcount)
    + return 0;
    +
    + if (get_user(p, &up->clips))
    + return -EFAULT;
    + uclips = compat_ptr(p);
    + while (n--) {
    + if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c)))
    + return -EFAULT;
    + uclips++;
    + kclips++;
    + }
    return 0;
    }

    \
     
     \ /
      Last update: 2018-02-28 17:08    [W:4.075 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site