Received: by 10.223.185.116 with SMTP id b49csp6342915wrg; Wed, 28 Feb 2018 07:54:17 -0800 (PST) X-Google-Smtp-Source: AH8x226ohl3NjGMrHQlE3gliI5eLhSTfJ5KCwnBOi3CDW1YN2YtE/Xsl83ctWT7TejHdSpY446rK X-Received: by 10.101.75.70 with SMTP id k6mr14995062pgt.335.1519833257610; Wed, 28 Feb 2018 07:54:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519833257; cv=none; d=google.com; s=arc-20160816; b=ccTMK3cKfDr0d7BR1KWmFIfv6SI6GntGWP2GpBqC+9Blwwc64uU/NPvfZ7g9uxc0mm 3hkcRTrRlbUXSpHHZ3qRDpKvo0mCN6Pd+xAg/7l3EuGEUpkPA17/BBU+7/mKJLD4sYQL HbJKYebnSkAAZtwVQvPCNg2gLrrFv32N4nRzzLRUL81jIxwbgFvzDAF4ozmD3YPATmjN tA4qqSnC2JEZmQKh6VdGY+1oGIlkHpEaqzzCcplpOmFN2liIBXPc25TZF2KdM1KadbsP PY3an5KlUf7lrH8D6p86ROuNniksXFRzsnW1abFqW2ENyR2GvidOcSHZ6TrYVJWvn4Rc NosQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=mxPo9nJ/sgjNnqA2exTL1ImHFqo5HXpnDFN1/5M8p/M=; b=NGuP+3oCJxWPpyJDPmI0LOESRhRam3FIZfOsftsY3bBG3+Lq6t9dAgTGjtaDwhlj77 fQxQvUcpUu3SYupLzd8KsPBl6npPIe7qXRVKpwuhpu5BHBF8jhszc0D5anLFRwJtDCTu NngaaeJrvXkE2xbiSU+/ubzlBnLBGYlRmAhGo/ai7wQktZfqxROj+Z1fubdMz4/ttEa4 S3moLgMCKlV9BSiIAscIQuZ3gIHgaOfr3aLTohPuatowNMcsCBDEBmjmITQD3fTDeISv aMGvLkiR3YmP8SmRjTYInIeJylboj1/M7LUTNTBK0YTGQKydvgAbC/Sd1GTB8/oZrco7 WAhw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a188si1170702pgc.183.2018.02.28.07.54.03; Wed, 28 Feb 2018 07:54:17 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934016AbeB1Px0 (ORCPT + 99 others); Wed, 28 Feb 2018 10:53:26 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:34445 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933975AbeB1PxV (ORCPT ); Wed, 28 Feb 2018 10:53:21 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Ym-0006Xe-5Q; Wed, 28 Feb 2018 15:22:24 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yl-0000Jn-1e; Wed, 28 Feb 2018 15:22:23 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Hans Verkuil" , "Sakari Ailus" , "Mauro Carvalho Chehab" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 246/254] media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Hans Verkuil commit 8ed5a59dcb47a6f76034ee760b36e089f3e82529 upstream. The struct v4l2_plane32 should set m.userptr as well. The same happens in v4l2_buffer32 and v4l2-compliance tests for this. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings --- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 47 ++++++++++++++++----------- 1 file changed, 28 insertions(+), 19 deletions(-) --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -290,19 +290,24 @@ static int get_v4l2_plane32(struct v4l2_ sizeof(up->data_offset))) return -EFAULT; - if (memory == V4L2_MEMORY_USERPTR) { + switch (memory) { + case V4L2_MEMORY_MMAP: + case V4L2_MEMORY_OVERLAY: + if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset, + sizeof(up32->m.mem_offset))) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: if (get_user(p, &up32->m.userptr)) return -EFAULT; up_pln = compat_ptr(p); if (put_user((unsigned long)up_pln, &up->m.userptr)) return -EFAULT; - } else if (memory == V4L2_MEMORY_DMABUF) { + break; + case V4L2_MEMORY_DMABUF: if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd))) return -EFAULT; - } else { - if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset, - sizeof(up32->m.mem_offset))) - return -EFAULT; + break; } return 0; @@ -311,22 +316,32 @@ static int get_v4l2_plane32(struct v4l2_ static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32, enum v4l2_memory memory) { + unsigned long p; + if (copy_in_user(up32, up, 2 * sizeof(__u32)) || copy_in_user(&up32->data_offset, &up->data_offset, sizeof(up->data_offset))) return -EFAULT; - /* For MMAP, driver might've set up the offset, so copy it back. - * USERPTR stays the same (was userspace-provided), so no copying. */ - if (memory == V4L2_MEMORY_MMAP) + switch (memory) { + case V4L2_MEMORY_MMAP: + case V4L2_MEMORY_OVERLAY: if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset, sizeof(up->m.mem_offset))) return -EFAULT; - /* For DMABUF, driver might've set up the fd, so copy it back. */ - if (memory == V4L2_MEMORY_DMABUF) + break; + case V4L2_MEMORY_USERPTR: + if (get_user(p, &up->m.userptr) || + put_user((compat_ulong_t)ptr_to_compat((__force void *)p), + &up32->m.userptr)) + return -EFAULT; + break; + case V4L2_MEMORY_DMABUF: if (copy_in_user(&up32->m.fd, &up->m.fd, sizeof(up->m.fd))) return -EFAULT; + break; + } return 0; } @@ -387,6 +402,7 @@ static int get_v4l2_buffer32(struct v4l2 } else { switch (kp->memory) { case V4L2_MEMORY_MMAP: + case V4L2_MEMORY_OVERLAY: if (get_user(kp->m.offset, &up->m.offset)) return -EFAULT; break; @@ -400,10 +416,6 @@ static int get_v4l2_buffer32(struct v4l2 kp->m.userptr = (unsigned long)compat_ptr(tmp); } break; - case V4L2_MEMORY_OVERLAY: - if (get_user(kp->m.offset, &up->m.offset)) - return -EFAULT; - break; case V4L2_MEMORY_DMABUF: if (get_user(kp->m.fd, &up->m.fd)) return -EFAULT; @@ -460,6 +472,7 @@ static int put_v4l2_buffer32(struct v4l2 } else { switch (kp->memory) { case V4L2_MEMORY_MMAP: + case V4L2_MEMORY_OVERLAY: if (put_user(kp->m.offset, &up->m.offset)) return -EFAULT; break; @@ -467,10 +480,6 @@ static int put_v4l2_buffer32(struct v4l2 if (put_user(kp->m.userptr, &up->m.userptr)) return -EFAULT; break; - case V4L2_MEMORY_OVERLAY: - if (put_user(kp->m.offset, &up->m.offset)) - return -EFAULT; - break; case V4L2_MEMORY_DMABUF: if (put_user(kp->m.fd, &up->m.fd)) return -EFAULT;