lkml.org 
[lkml]   [2016]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 70/98] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
    Date
    From: Tiffany Lin <tiffany.lin@mediatek.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream.

    In v4l2-compliance utility, test QUERYBUF required correct length
    value to go through each planar to check planar's length in
    multi-planar buffer type

    Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 21 ++++++++-------------
    1 file changed, 8 insertions(+), 13 deletions(-)

    diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    index 2bece37d0228..61c2cd3be109 100644
    --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    @@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    get_user(kp->index, &up->index) ||
    get_user(kp->type, &up->type) ||
    get_user(kp->flags, &up->flags) ||
    - get_user(kp->memory, &up->memory))
    + get_user(kp->memory, &up->memory) ||
    + get_user(kp->length, &up->length))
    return -EFAULT;

    if (V4L2_TYPE_IS_OUTPUT(kp->type))
    @@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    return -EFAULT;

    if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
    - if (get_user(kp->length, &up->length))
    - return -EFAULT;
    -
    num_planes = kp->length;
    if (num_planes == 0) {
    kp->m.planes = NULL;
    @@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    } else {
    switch (kp->memory) {
    case V4L2_MEMORY_MMAP:
    - if (get_user(kp->length, &up->length) ||
    - get_user(kp->m.offset, &up->m.offset))
    + if (get_user(kp->m.offset, &up->m.offset))
    return -EFAULT;
    break;
    case V4L2_MEMORY_USERPTR:
    {
    compat_long_t tmp;

    - if (get_user(kp->length, &up->length) ||
    - get_user(tmp, &up->m.userptr))
    + if (get_user(tmp, &up->m.userptr))
    return -EFAULT;

    kp->m.userptr = (unsigned long)compat_ptr(tmp);
    @@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
    put_user(kp->sequence, &up->sequence) ||
    put_user(kp->reserved2, &up->reserved2) ||
    - put_user(kp->reserved, &up->reserved))
    + put_user(kp->reserved, &up->reserved) ||
    + put_user(kp->length, &up->length))
    return -EFAULT;

    if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
    @@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    } else {
    switch (kp->memory) {
    case V4L2_MEMORY_MMAP:
    - if (put_user(kp->length, &up->length) ||
    - put_user(kp->m.offset, &up->m.offset))
    + if (put_user(kp->m.offset, &up->m.offset))
    return -EFAULT;
    break;
    case V4L2_MEMORY_USERPTR:
    - if (put_user(kp->length, &up->length) ||
    - put_user(kp->m.userptr, &up->m.userptr))
    + if (put_user(kp->m.userptr, &up->m.userptr))
    return -EFAULT;
    break;
    case V4L2_MEMORY_OVERLAY:
    --
    2.8.1
    \
     
     \ /
      Last update: 2016-04-11 16:02    [W:2.587 / U:0.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site