lkml.org 
[lkml]   [2016]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2.y-ckt 023/218] [media] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
    Date
    4.2.8-ckt7 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Tiffany Lin <tiffany.lin@mediatek.com>

    commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream.

    In v4l2-compliance utility, test QUERYBUF required correct length
    value to go through each planar to check planar's length in
    multi-planar buffer type

    Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 21 ++++++++-------------
    1 file changed, 8 insertions(+), 13 deletions(-)

    diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    index 788b31c..73138a3 100644
    --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    @@ -394,7 +394,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    get_user(kp->index, &up->index) ||
    get_user(kp->type, &up->type) ||
    get_user(kp->flags, &up->flags) ||
    - get_user(kp->memory, &up->memory))
    + get_user(kp->memory, &up->memory) ||
    + get_user(kp->length, &up->length))
    return -EFAULT;

    if (V4L2_TYPE_IS_OUTPUT(kp->type))
    @@ -406,9 +407,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    return -EFAULT;

    if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
    - if (get_user(kp->length, &up->length))
    - return -EFAULT;
    -
    num_planes = kp->length;
    if (num_planes == 0) {
    kp->m.planes = NULL;
    @@ -441,16 +439,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    } else {
    switch (kp->memory) {
    case V4L2_MEMORY_MMAP:
    - if (get_user(kp->length, &up->length) ||
    - get_user(kp->m.offset, &up->m.offset))
    + if (get_user(kp->m.offset, &up->m.offset))
    return -EFAULT;
    break;
    case V4L2_MEMORY_USERPTR:
    {
    compat_long_t tmp;

    - if (get_user(kp->length, &up->length) ||
    - get_user(tmp, &up->m.userptr))
    + if (get_user(tmp, &up->m.userptr))
    return -EFAULT;

    kp->m.userptr = (unsigned long)compat_ptr(tmp);
    @@ -492,7 +488,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
    put_user(kp->sequence, &up->sequence) ||
    put_user(kp->reserved2, &up->reserved2) ||
    - put_user(kp->reserved, &up->reserved))
    + put_user(kp->reserved, &up->reserved) ||
    + put_user(kp->length, &up->length))
    return -EFAULT;

    if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
    @@ -515,13 +512,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
    } else {
    switch (kp->memory) {
    case V4L2_MEMORY_MMAP:
    - if (put_user(kp->length, &up->length) ||
    - put_user(kp->m.offset, &up->m.offset))
    + if (put_user(kp->m.offset, &up->m.offset))
    return -EFAULT;
    break;
    case V4L2_MEMORY_USERPTR:
    - if (put_user(kp->length, &up->length) ||
    - put_user(kp->m.userptr, &up->m.userptr))
    + if (put_user(kp->m.userptr, &up->m.userptr))
    return -EFAULT;
    break;
    case V4L2_MEMORY_OVERLAY:
    --
    2.7.4
    \
     
     \ /
      Last update: 2016-03-31 23:41    [W:2.631 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site