lkml.org 
[lkml]   [2018]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 077/108] media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Hans Verkuil <hans.verkuil@cisco.com>

    commit 8ed5a59dcb47a6f76034ee760b36e089f3e82529 upstream.

    The struct v4l2_plane32 should set m.userptr as well. The same
    happens in v4l2_buffer32 and v4l2-compliance tests for this.

    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 47 +++++++++++++++-----------
    1 file changed, 28 insertions(+), 19 deletions(-)

    --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    @@ -299,19 +299,24 @@ static int get_v4l2_plane32(struct v4l2_
    sizeof(up->data_offset)))
    return -EFAULT;

    - if (memory == V4L2_MEMORY_USERPTR) {
    + switch (memory) {
    + case V4L2_MEMORY_MMAP:
    + case V4L2_MEMORY_OVERLAY:
    + if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
    + sizeof(up32->m.mem_offset)))
    + return -EFAULT;
    + break;
    + case V4L2_MEMORY_USERPTR:
    if (get_user(p, &up32->m.userptr))
    return -EFAULT;
    up_pln = compat_ptr(p);
    if (put_user((unsigned long)up_pln, &up->m.userptr))
    return -EFAULT;
    - } else if (memory == V4L2_MEMORY_DMABUF) {
    + break;
    + case V4L2_MEMORY_DMABUF:
    if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd)))
    return -EFAULT;
    - } else {
    - if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
    - sizeof(up32->m.mem_offset)))
    - return -EFAULT;
    + break;
    }

    return 0;
    @@ -320,22 +325,32 @@ static int get_v4l2_plane32(struct v4l2_
    static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
    enum v4l2_memory memory)
    {
    + unsigned long p;
    +
    if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
    copy_in_user(&up32->data_offset, &up->data_offset,
    sizeof(up->data_offset)))
    return -EFAULT;

    - /* For MMAP, driver might've set up the offset, so copy it back.
    - * USERPTR stays the same (was userspace-provided), so no copying. */
    - if (memory == V4L2_MEMORY_MMAP)
    + switch (memory) {
    + case V4L2_MEMORY_MMAP:
    + case V4L2_MEMORY_OVERLAY:
    if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
    sizeof(up->m.mem_offset)))
    return -EFAULT;
    - /* For DMABUF, driver might've set up the fd, so copy it back. */
    - if (memory == V4L2_MEMORY_DMABUF)
    + break;
    + case V4L2_MEMORY_USERPTR:
    + if (get_user(p, &up->m.userptr) ||
    + put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
    + &up32->m.userptr))
    + return -EFAULT;
    + break;
    + case V4L2_MEMORY_DMABUF:
    if (copy_in_user(&up32->m.fd, &up->m.fd,
    sizeof(up->m.fd)))
    return -EFAULT;
    + break;
    + }

    return 0;
    }
    @@ -395,6 +410,7 @@ static int get_v4l2_buffer32(struct v4l2
    } else {
    switch (kp->memory) {
    case V4L2_MEMORY_MMAP:
    + case V4L2_MEMORY_OVERLAY:
    if (get_user(kp->m.offset, &up->m.offset))
    return -EFAULT;
    break;
    @@ -408,10 +424,6 @@ static int get_v4l2_buffer32(struct v4l2
    kp->m.userptr = (unsigned long)compat_ptr(tmp);
    }
    break;
    - case V4L2_MEMORY_OVERLAY:
    - if (get_user(kp->m.offset, &up->m.offset))
    - return -EFAULT;
    - break;
    case V4L2_MEMORY_DMABUF:
    if (get_user(kp->m.fd, &up->m.fd))
    return -EFAULT;
    @@ -468,6 +480,7 @@ static int put_v4l2_buffer32(struct v4l2
    } else {
    switch (kp->memory) {
    case V4L2_MEMORY_MMAP:
    + case V4L2_MEMORY_OVERLAY:
    if (put_user(kp->m.offset, &up->m.offset))
    return -EFAULT;
    break;
    @@ -475,10 +488,6 @@ static int put_v4l2_buffer32(struct v4l2
    if (put_user(kp->m.userptr, &up->m.userptr))
    return -EFAULT;
    break;
    - case V4L2_MEMORY_OVERLAY:
    - if (put_user(kp->m.offset, &up->m.offset))
    - return -EFAULT;
    - break;
    case V4L2_MEMORY_DMABUF:
    if (put_user(kp->m.fd, &up->m.fd))
    return -EFAULT;

    \
     
     \ /
      Last update: 2018-02-15 19:40    [W:4.025 / U:0.324 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site