evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32

Browse source 
commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream.

In v4l2-compliance utility, test QUERYBUF required correct length
value to go through each planar to check planar's length in
multi-planar buffer type

Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Tiffany Lin 2016-01-19 05:56:50 -02:00 • committed by Greg Kroah-Hartman
parent 6aed423a0e
commit 8c1fa99764
1 changed files with 8 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
drivers/media/v4l2-core/v4l2-compat-ioctl32.c
View file

@ -415,7 +415,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
get_user(kp->index, &up->index) || get_user(kp->index, &up->index) ||
get_user(kp->type, &up->type) || get_user(kp->type, &up->type) ||
get_user(kp->flags, &up->flags) || get_user(kp->flags, &up->flags) ||
get_user(kp->memory, &up->memory)) get_user(kp->memory, &up->memory) ||
get_user(kp->length, &up->length))
return -EFAULT; return -EFAULT;
if (V4L2_TYPE_IS_OUTPUT(kp->type)) if (V4L2_TYPE_IS_OUTPUT(kp->type))
@ -427,9 +428,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
return -EFAULT; return -EFAULT;
if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
if (get_user(kp->length, &up->length))
return -EFAULT;
num_planes = kp->length; num_planes = kp->length;
if (num_planes == 0) { if (num_planes == 0) {
kp->m.planes = NULL; kp->m.planes = NULL;
@ -462,16 +460,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
} else { } else {
switch (kp->memory) { switch (kp->memory) {
case V4L2_MEMORY_MMAP: case V4L2_MEMORY_MMAP:
if (get_user(kp->length, &up->length) || if (get_user(kp->m.offset, &up->m.offset))
get_user(kp->m.offset, &up->m.offset))
return -EFAULT; return -EFAULT;
break; break;
case V4L2_MEMORY_USERPTR: case V4L2_MEMORY_USERPTR:
{ {
compat_long_t tmp; compat_long_t tmp;
if (get_user(kp->length, &up->length) || if (get_user(tmp, &up->m.userptr))
get_user(tmp, &up->m.userptr))
return -EFAULT; return -EFAULT;
kp->m.userptr = (unsigned long)compat_ptr(tmp); kp->m.userptr = (unsigned long)compat_ptr(tmp);
@ -513,7 +509,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
put_user(kp->sequence, &up->sequence) || put_user(kp->sequence, &up->sequence) ||
put_user(kp->reserved2, &up->reserved2) || put_user(kp->reserved2, &up->reserved2) ||
put_user(kp->reserved, &up->reserved)) put_user(kp->reserved, &up->reserved) ||
put_user(kp->length, &up->length))
return -EFAULT; return -EFAULT;
if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
@ -536,13 +533,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
} else { } else {
switch (kp->memory) { switch (kp->memory) {
case V4L2_MEMORY_MMAP: case V4L2_MEMORY_MMAP:
if (put_user(kp->length, &up->length) || if (put_user(kp->m.offset, &up->m.offset))
put_user(kp->m.offset, &up->m.offset))
return -EFAULT; return -EFAULT;
break; break;
case V4L2_MEMORY_USERPTR: case V4L2_MEMORY_USERPTR:
if (put_user(kp->length, &up->length) || if (put_user(kp->m.userptr, &up->m.userptr))
put_user(kp->m.userptr, &up->m.userptr))
return -EFAULT; return -EFAULT;
break; break;
case V4L2_MEMORY_OVERLAY: case V4L2_MEMORY_OVERLAY: