media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream. In v4l2-compliance utility, test QUERYBUF required correct length value to go through each planar to check planar's length in multi-planar buffer type Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: <stable@vger.kernel.org> # for v3.7 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Willy Tarreau <w@1wt.eu>
This commit is contained in:
parent
d2d7a79a63
commit
68d6ceb7be
|
@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
get_user(kp->index, &up->index) ||
|
||||
get_user(kp->type, &up->type) ||
|
||||
get_user(kp->flags, &up->flags) ||
|
||||
get_user(kp->memory, &up->memory))
|
||||
get_user(kp->memory, &up->memory) ||
|
||||
get_user(kp->length, &up->length))
|
||||
return -EFAULT;
|
||||
|
||||
if (V4L2_TYPE_IS_OUTPUT(kp->type))
|
||||
|
@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
return -EFAULT;
|
||||
|
||||
if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
|
||||
if (get_user(kp->length, &up->length))
|
||||
return -EFAULT;
|
||||
|
||||
num_planes = kp->length;
|
||||
if (num_planes == 0) {
|
||||
kp->m.planes = NULL;
|
||||
|
@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
} else {
|
||||
switch (kp->memory) {
|
||||
case V4L2_MEMORY_MMAP:
|
||||
if (get_user(kp->length, &up->length) ||
|
||||
get_user(kp->m.offset, &up->m.offset))
|
||||
if (get_user(kp->m.offset, &up->m.offset))
|
||||
return -EFAULT;
|
||||
break;
|
||||
case V4L2_MEMORY_USERPTR:
|
||||
{
|
||||
compat_long_t tmp;
|
||||
|
||||
if (get_user(kp->length, &up->length) ||
|
||||
get_user(tmp, &up->m.userptr))
|
||||
if (get_user(tmp, &up->m.userptr))
|
||||
return -EFAULT;
|
||||
|
||||
kp->m.userptr = (unsigned long)compat_ptr(tmp);
|
||||
|
@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) ||
|
||||
put_user(kp->sequence, &up->sequence) ||
|
||||
put_user(kp->reserved2, &up->reserved2) ||
|
||||
put_user(kp->reserved, &up->reserved))
|
||||
put_user(kp->reserved, &up->reserved) ||
|
||||
put_user(kp->length, &up->length))
|
||||
return -EFAULT;
|
||||
|
||||
if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) {
|
||||
|
@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|||
} else {
|
||||
switch (kp->memory) {
|
||||
case V4L2_MEMORY_MMAP:
|
||||
if (put_user(kp->length, &up->length) ||
|
||||
put_user(kp->m.offset, &up->m.offset))
|
||||
if (put_user(kp->m.offset, &up->m.offset))
|
||||
return -EFAULT;
|
||||
break;
|
||||
case V4L2_MEMORY_USERPTR:
|
||||
if (put_user(kp->length, &up->length) ||
|
||||
put_user(kp->m.userptr, &up->m.userptr))
|
||||
if (put_user(kp->m.userptr, &up->m.userptr))
|
||||
return -EFAULT;
|
||||
break;
|
||||
case V4L2_MEMORY_OVERLAY:
|
||||
|
|
Loading…
Reference in New Issue