Received: by 10.223.185.116 with SMTP id b49csp6361706wrg; Wed, 28 Feb 2018 08:10:29 -0800 (PST) X-Google-Smtp-Source: AH8x224TL3aHvJBQVFioKCGZJXHlYqZpIiJpYCG4kYa1CGqhAAqXEbN/82IJGuVKzuIaA8yPCoXf X-Received: by 10.101.82.198 with SMTP id z6mr14551242pgp.41.1519834229404; Wed, 28 Feb 2018 08:10:29 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519834229; cv=none; d=google.com; s=arc-20160816; b=PXBZFJkovW7N638jpUc2PkiceBBes6K1pFxztvi7w68WVxFEFN1EtePUgiWHE5FljL 3OWmjOwptjoe96vJWteC65gUY+nJgTlT05xHS2CVFZGAdBJcwYsXIYvTX0lV6jEWDKIl rlOXYaAo6z93+2A2a/mR4vTelOzhrycp/yqpQff0kRyXN/bJAeFS2RQudFbyzUD+TmB0 XYeqpj8KV3G0G7SCpQmMyDGNnsUeTclqDGZY9VfgS93AEDxfsYbNyIFsS91Tn6nAwc38 l63WE0HBktlWbUx8oXC5YWTJoifY1Hqy3XJT0hxEEAbbjb8A2s07JZqtm/IQtp4hb4zv ZuOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=waET0nKPD0GHX9O9kCYRLfb+Z1fYc8tBVnc2Q988Wzk=; b=FMRwJ5uVodjbX9VrcIOLPkyno57L+TbcOQLXlLGm+gpZ9hEGkzbw8VokP+zlWueuR2 iHp4psw6zgp6IQRzs1kv5Y06YvvJYa+Q2cahVJ8MNwDr1lCMNG28x4XqblngnVBAy5Ey JuFG+ASQiegv+YFDl4YYzvnSVOEchGjS/h+gk/2zrgKcOUq5FZktW6pXoicAif+oW+DC k4DNh8imwRCO+Ur0vA71cmG6usuOWTWTyADvzAQcvRhsCQXHZ9g+vpx2N2d9tVVbbiSB 2kOVQ/R7iGyRsuur+R5zmLE9HyU1vo8l/w4D7H+eIOljCDzSw54kbzCWi+MjLoL4oyOY E1KQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f4-v6si1465122plr.267.2018.02.28.08.10.14; Wed, 28 Feb 2018 08:10:29 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934559AbeB1QIJ (ORCPT + 99 others); Wed, 28 Feb 2018 11:08:09 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:34860 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753135AbeB1QFF (ORCPT ); Wed, 28 Feb 2018 11:05:05 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Ym-0006XP-GT; Wed, 28 Feb 2018 15:22:25 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yl-0000K1-4V; Wed, 28 Feb 2018 15:22:23 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Mauro Carvalho Chehab" , "Sakari Ailus" , "Hans Verkuil" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 249/254] media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Hans Verkuil commit a751be5b142ef6bcbbb96d9899516f4d9c8d0ef4 upstream. put_v4l2_window32() didn't copy back the clip list to userspace. Drivers can update the clip rectangles, so this should be done. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Ben Hutchings --- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 59 ++++++++++++++++++--------- 1 file changed, 40 insertions(+), 19 deletions(-) --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -50,6 +50,11 @@ struct v4l2_window32 { static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) { + struct v4l2_clip32 __user *uclips; + struct v4l2_clip __user *kclips; + compat_caddr_t p; + u32 n; + if (!access_ok(VERIFY_READ, up, sizeof(*up)) || copy_from_user(&kp->w, &up->w, sizeof(up->w)) || get_user(kp->field, &up->field) || @@ -59,38 +64,54 @@ static int get_v4l2_window32(struct v4l2 return -EFAULT; if (kp->clipcount > 2048) return -EINVAL; - if (kp->clipcount) { - struct v4l2_clip32 __user *uclips; - struct v4l2_clip __user *kclips; - int n = kp->clipcount; - compat_caddr_t p; + if (!kp->clipcount) { + kp->clips = NULL; + return 0; + } - if (get_user(p, &up->clips)) + n = kp->clipcount; + if (get_user(p, &up->clips)) + return -EFAULT; + uclips = compat_ptr(p); + kclips = compat_alloc_user_space(n * sizeof(*kclips)); + kp->clips = kclips; + while (n--) { + if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) return -EFAULT; - uclips = compat_ptr(p); - kclips = compat_alloc_user_space(n * sizeof(*kclips)); - kp->clips = kclips; - while (--n >= 0) { - if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) - return -EFAULT; - if (put_user(n ? kclips + 1 : NULL, &kclips->next)) - return -EFAULT; - uclips += 1; - kclips += 1; - } - } else - kp->clips = NULL; + if (put_user(n ? kclips + 1 : NULL, &kclips->next)) + return -EFAULT; + uclips++; + kclips++; + } return 0; } static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) { + struct v4l2_clip __user *kclips = kp->clips; + struct v4l2_clip32 __user *uclips; + u32 n = kp->clipcount; + compat_caddr_t p; + if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) || put_user(kp->field, &up->field) || put_user(kp->chromakey, &up->chromakey) || put_user(kp->clipcount, &up->clipcount) || put_user(kp->global_alpha, &up->global_alpha)) return -EFAULT; + + if (!kp->clipcount) + return 0; + + if (get_user(p, &up->clips)) + return -EFAULT; + uclips = compat_ptr(p); + while (n--) { + if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c))) + return -EFAULT; + uclips++; + kclips++; + } return 0; }