mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-09-21 03:43:03 +00:00
media: v4l2-compat-ioctl32.c: avoid sizeof(type)
commit 333b1e9f96ce05f7498b581509bb30cde03018bf upstream. Instead of doing sizeof(struct foo) use sizeof(*up). There even were cases where 4 * sizeof(__u32) was used instead of sizeof(kp->reserved), which is very dangerous when the size of the reserved array changes. Change-Id: Iccacac59fcff791518af759680b51ffe2097b9bc Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> [bwh: Rebased on top of some earlier fixes] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
ce4c975bf7
commit
50c70c5f1f
|
@ -47,7 +47,7 @@ struct v4l2_window32 {
|
|||
|
||||
static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_window32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
copy_from_user(&kp->w, &up->w, sizeof(up->w)) ||
|
||||
get_user(kp->field, &up->field) ||
|
||||
get_user(kp->chromakey, &up->chromakey) ||
|
||||
|
@ -64,7 +64,7 @@ static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
|
|||
if (get_user(p, &up->clips))
|
||||
return -EFAULT;
|
||||
uclips = compat_ptr(p);
|
||||
kclips = compat_alloc_user_space(n * sizeof(struct v4l2_clip));
|
||||
kclips = compat_alloc_user_space(n * sizeof(*kclips));
|
||||
kp->clips = kclips;
|
||||
while (--n >= 0) {
|
||||
if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
|
||||
|
@ -152,14 +152,14 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
|
|||
|
||||
static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)))
|
||||
return -EFAULT;
|
||||
return __get_v4l2_format32(kp, up);
|
||||
}
|
||||
|
||||
static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
|
||||
return -EFAULT;
|
||||
return __get_v4l2_format32(&kp->format, &up->format);
|
||||
|
@ -199,14 +199,14 @@ static int __put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
|
|||
|
||||
static int put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_format32)))
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
|
||||
return -EFAULT;
|
||||
return __put_v4l2_format32(kp, up);
|
||||
}
|
||||
|
||||
static int put_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_create_buffers32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
copy_to_user(up, kp, offsetof(struct v4l2_create_buffers32, format)) ||
|
||||
copy_to_user(up->reserved, kp->reserved, sizeof(kp->reserved)))
|
||||
return -EFAULT;
|
||||
|
@ -225,7 +225,7 @@ struct v4l2_standard32 {
|
|||
static int get_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 __user *up)
|
||||
{
|
||||
/* other fields are not set by the user, nor used by the driver */
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_standard32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
get_user(kp->index, &up->index))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
|
@ -233,13 +233,13 @@ static int get_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32
|
|||
|
||||
static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
put_user(kp->index, &up->index) ||
|
||||
put_user(kp->id, &up->id) ||
|
||||
copy_to_user(up->name, kp->name, 24) ||
|
||||
copy_to_user(up->name, kp->name, sizeof(up->name)) ||
|
||||
copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) ||
|
||||
put_user(kp->framelines, &up->framelines) ||
|
||||
copy_to_user(up->reserved, kp->reserved, 4 * sizeof(__u32)))
|
||||
copy_to_user(up->reserved, kp->reserved, sizeof(kp->reserved)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
}
|
||||
|
@ -287,11 +287,11 @@ static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __
|
|||
|
||||
if (copy_in_user(up, up32, 2 * sizeof(__u32)) ||
|
||||
copy_in_user(&up->data_offset, &up32->data_offset,
|
||||
sizeof(__u32)) ||
|
||||
sizeof(up->data_offset)) ||
|
||||
copy_in_user(up->reserved, up32->reserved,
|
||||
sizeof(up->reserved)) ||
|
||||
copy_in_user(&up->length, &up32->length,
|
||||
sizeof(__u32)))
|
||||
sizeof(up->length)))
|
||||
return -EFAULT;
|
||||
|
||||
if (memory == V4L2_MEMORY_USERPTR) {
|
||||
|
@ -301,11 +301,11 @@ static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __
|
|||
if (put_user((unsigned long)up_pln, &up->m.userptr))
|
||||
return -EFAULT;
|
||||
} else if (memory == V4L2_MEMORY_DMABUF) {
|
||||
if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(int)))
|
||||
if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd)))
|
||||
return -EFAULT;
|
||||
} else {
|
||||
if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
|
||||
sizeof(__u32)))
|
||||
sizeof(up32->m.mem_offset)))
|
||||
return -EFAULT;
|
||||
}
|
||||
|
||||
|
@ -319,19 +319,19 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __
|
|||
copy_in_user(up32->reserved, up->reserved,
|
||||
sizeof(up32->reserved)) ||
|
||||
copy_in_user(&up32->data_offset, &up->data_offset,
|
||||
sizeof(__u32)))
|
||||
sizeof(up->data_offset)))
|
||||
return -EFAULT;
|
||||
|
||||
/* For MMAP, driver might've set up the offset, so copy it back.
|
||||
* USERPTR stays the same (was userspace-provided), so no copying. */
|
||||
if (memory == V4L2_MEMORY_MMAP)
|
||||
if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
|
||||
sizeof(__u32)))
|
||||
sizeof(up->m.mem_offset)))
|
||||
return -EFAULT;
|
||||
/* For DMABUF, driver might've set up the fd, so copy it back. */
|
||||
if (memory == V4L2_MEMORY_DMABUF)
|
||||
if (copy_in_user(&up32->m.fd, &up->m.fd,
|
||||
sizeof(int)))
|
||||
sizeof(up->m.fd)))
|
||||
return -EFAULT;
|
||||
|
||||
return 0;
|
||||
|
@ -345,7 +345,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
int num_planes;
|
||||
int ret;
|
||||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_buffer32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
get_user(kp->index, &up->index) ||
|
||||
get_user(kp->type, &up->type) ||
|
||||
get_user(kp->flags, &up->flags) ||
|
||||
|
@ -357,8 +357,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
if (get_user(kp->bytesused, &up->bytesused) ||
|
||||
get_user(kp->field, &up->field) ||
|
||||
get_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) ||
|
||||
get_user(kp->timestamp.tv_usec,
|
||||
&up->timestamp.tv_usec))
|
||||
get_user(kp->timestamp.tv_usec, &up->timestamp.tv_usec))
|
||||
return -EFAULT;
|
||||
|
||||
if (V4L2_TYPE_IS_PRIVATE(kp->type)) {
|
||||
|
@ -385,13 +384,13 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
|
||||
uplane32 = compat_ptr(p);
|
||||
if (!access_ok(VERIFY_READ, uplane32,
|
||||
num_planes * sizeof(struct v4l2_plane32)))
|
||||
num_planes * sizeof(*uplane32)))
|
||||
return -EFAULT;
|
||||
|
||||
/* We don't really care if userspace decides to kill itself
|
||||
* by passing a very big num_planes value */
|
||||
uplane = compat_alloc_user_space(num_planes *
|
||||
sizeof(struct v4l2_plane));
|
||||
sizeof(*uplane));
|
||||
kp->m.planes = (__force struct v4l2_plane *)uplane;
|
||||
|
||||
while (--num_planes >= 0) {
|
||||
|
@ -439,7 +438,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
int num_planes;
|
||||
int ret;
|
||||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_buffer32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
put_user(kp->index, &up->index) ||
|
||||
put_user(kp->type, &up->type) ||
|
||||
put_user(kp->flags, &up->flags) ||
|
||||
|
@ -450,7 +449,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
put_user(kp->field, &up->field) ||
|
||||
put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) ||
|
||||
put_user(kp->timestamp.tv_usec, &up->timestamp.tv_usec) ||
|
||||
copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
|
||||
copy_to_user(&up->timecode, &kp->timecode, sizeof(kp->timecode)) ||
|
||||
put_user(kp->sequence, &up->sequence) ||
|
||||
put_user(kp->reserved2, &up->reserved2) ||
|
||||
put_user(kp->reserved, &up->reserved) ||
|
||||
|
@ -515,7 +514,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
|
|||
{
|
||||
u32 tmp;
|
||||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_framebuffer32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
get_user(tmp, &up->base) ||
|
||||
get_user(kp->capability, &up->capability) ||
|
||||
get_user(kp->flags, &up->flags) ||
|
||||
|
@ -529,7 +528,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
|
|||
{
|
||||
u32 tmp = (u32)((unsigned long)kp->base);
|
||||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_framebuffer32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
put_user(tmp, &up->base) ||
|
||||
put_user(kp->capability, &up->capability) ||
|
||||
put_user(kp->flags, &up->flags) ||
|
||||
|
@ -554,14 +553,14 @@ struct v4l2_input32 {
|
|||
Otherwise it is identical to the 32-bit version. */
|
||||
static inline int get_v4l2_input32(struct v4l2_input *kp, struct v4l2_input32 __user *up)
|
||||
{
|
||||
if (copy_from_user(kp, up, sizeof(struct v4l2_input32)))
|
||||
if (copy_from_user(kp, up, sizeof(*up)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int put_v4l2_input32(struct v4l2_input *kp, struct v4l2_input32 __user *up)
|
||||
{
|
||||
if (copy_to_user(up, kp, sizeof(struct v4l2_input32)))
|
||||
if (copy_to_user(up, kp, sizeof(*up)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
}
|
||||
|
@ -609,7 +608,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|||
int n;
|
||||
compat_caddr_t p;
|
||||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_ext_controls32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
get_user(kp->ctrl_class, &up->ctrl_class) ||
|
||||
get_user(kp->count, &up->count) ||
|
||||
get_user(kp->error_idx, &up->error_idx) ||
|
||||
|
@ -623,10 +622,9 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|||
if (get_user(p, &up->controls))
|
||||
return -EFAULT;
|
||||
ucontrols = compat_ptr(p);
|
||||
if (!access_ok(VERIFY_READ, ucontrols,
|
||||
n * sizeof(struct v4l2_ext_control32)))
|
||||
if (!access_ok(VERIFY_READ, ucontrols, n * sizeof(*ucontrols)))
|
||||
return -EFAULT;
|
||||
kcontrols = compat_alloc_user_space(n * sizeof(struct v4l2_ext_control));
|
||||
kcontrols = compat_alloc_user_space(n * sizeof(*kcontrols));
|
||||
kp->controls = (__force struct v4l2_ext_control *)kcontrols;
|
||||
while (--n >= 0) {
|
||||
u32 id;
|
||||
|
@ -658,7 +656,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|||
int n = kp->count;
|
||||
compat_caddr_t p;
|
||||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_ext_controls32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
put_user(kp->ctrl_class, &up->ctrl_class) ||
|
||||
put_user(kp->count, &up->count) ||
|
||||
put_user(kp->error_idx, &up->error_idx) ||
|
||||
|
@ -670,8 +668,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|||
if (get_user(p, &up->controls))
|
||||
return -EFAULT;
|
||||
ucontrols = compat_ptr(p);
|
||||
if (!access_ok(VERIFY_WRITE, ucontrols,
|
||||
n * sizeof(struct v4l2_ext_control32)))
|
||||
if (!access_ok(VERIFY_WRITE, ucontrols, n * sizeof(*ucontrols)))
|
||||
return -EFAULT;
|
||||
|
||||
while (--n >= 0) {
|
||||
|
@ -708,14 +705,14 @@ struct v4l2_event32 {
|
|||
|
||||
static int put_v4l2_event32(struct v4l2_event *kp, struct v4l2_event32 __user *up)
|
||||
{
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_event32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
put_user(kp->type, &up->type) ||
|
||||
copy_to_user(&up->u, &kp->u, sizeof(kp->u)) ||
|
||||
put_user(kp->pending, &up->pending) ||
|
||||
put_user(kp->sequence, &up->sequence) ||
|
||||
put_compat_timespec(&kp->timestamp, &up->timestamp) ||
|
||||
put_user(kp->id, &up->id) ||
|
||||
copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32)))
|
||||
copy_to_user(up->reserved, kp->reserved, sizeof(kp->reserved)))
|
||||
return -EFAULT;
|
||||
return 0;
|
||||
}
|
||||
|
@ -732,7 +729,7 @@ static int get_v4l2_subdev_edid32(struct v4l2_subdev_edid *kp, struct v4l2_subde
|
|||
{
|
||||
u32 tmp;
|
||||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_subdev_edid32)) ||
|
||||
if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
|
||||
get_user(kp->pad, &up->pad) ||
|
||||
get_user(kp->start_block, &up->start_block) ||
|
||||
get_user(kp->blocks, &up->blocks) ||
|
||||
|
@ -747,7 +744,7 @@ static int put_v4l2_subdev_edid32(struct v4l2_subdev_edid *kp, struct v4l2_subde
|
|||
{
|
||||
u32 tmp = (u32)((unsigned long)kp->edid);
|
||||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_subdev_edid32)) ||
|
||||
if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
|
||||
put_user(kp->pad, &up->pad) ||
|
||||
put_user(kp->start_block, &up->start_block) ||
|
||||
put_user(kp->blocks, &up->blocks) ||
|
||||
|
|
Loading…
Reference in a new issue