Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30ac343c authored by Hans Verkuil's avatar Hans Verkuil Committed by Greg Kroah-Hartman
Browse files

media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 



commit a751be5b142ef6bcbbb96d9899516f4d9c8d0ef4 upstream.

put_v4l2_window32() didn't copy back the clip list to userspace.
Drivers can update the clip rectangles, so this should be done.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Acked-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 55e3f3e6

drivers/media/v4l2-core/v4l2-compat-ioctl32.c

+40 −19
Original line number Diff line number Diff line
@@ -50,6 +50,11 @@ struct v4l2_window32 { 


static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)

{

	struct v4l2_clip32 __user *uclips;

	struct v4l2_clip __user *kclips;

	compat_caddr_t p;

	u32 n;



	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||

	    copy_from_user(&kp->w, &up->w, sizeof(up->w)) ||

	    get_user(kp->field, &up->field) ||
@@ -59,38 +64,54 @@ static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user 
		return -EFAULT;

	if (kp->clipcount > 2048)

		return -EINVAL;

	if (kp->clipcount) {

		struct v4l2_clip32 __user *uclips;

		struct v4l2_clip __user *kclips;

		int n = kp->clipcount;

		compat_caddr_t p;

	if (!kp->clipcount) {

		kp->clips = NULL;

		return 0;

	}



	n = kp->clipcount;

	if (get_user(p, &up->clips))

		return -EFAULT;

	uclips = compat_ptr(p);

	kclips = compat_alloc_user_space(n * sizeof(*kclips));

	kp->clips = kclips;

		while (--n >= 0) {

	while (n--) {

		if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))

			return -EFAULT;

		if (put_user(n ? kclips + 1 : NULL, &kclips->next))

			return -EFAULT;

			uclips += 1;

			kclips += 1;

		uclips++;

		kclips++;

	}

	} else

		kp->clips = NULL;

	return 0;

}



static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)

{

	struct v4l2_clip __user *kclips = kp->clips;

	struct v4l2_clip32 __user *uclips;

	u32 n = kp->clipcount;

	compat_caddr_t p;



	if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) ||

	    put_user(kp->field, &up->field) ||

	    put_user(kp->chromakey, &up->chromakey) ||

	    put_user(kp->clipcount, &up->clipcount) ||

	    put_user(kp->global_alpha, &up->global_alpha))

		return -EFAULT;



	if (!kp->clipcount)

		return 0;



	if (get_user(p, &up->clips))

		return -EFAULT;

	uclips = compat_ptr(p);

	while (n--) {

		if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c)))

			return -EFAULT;

		uclips++;

		kclips++;

	}

	return 0;

}