Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ddda4249 authored by Andy Walls's avatar Andy Walls Committed by Mauro Carvalho Chehab
Browse files

[media] ivtv: Return EFAULT when copy_from_user() fails in ivtv_write_vbi_from_user() 



If write() on a VBI device node fails due to a bad buffer pointer from
userspace, we should notify the application properly with EFAULT, per the
V4L2 API spec.

Signed-off-by: default avatarAndy Walls <awalls@md.metrocast.net>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent b0c45686

drivers/media/video/ivtv/ivtv-fileops.c

+1 −2
Original line number Diff line number Diff line
@@ -570,9 +570,8 @@ ssize_t ivtv_v4l2_write(struct file *filp, const char __user *user_buf, size_t c 
		int elems = count / sizeof(struct v4l2_sliced_vbi_data);



		set_bit(IVTV_F_S_APPL_IO, &s->s_flags);

		ivtv_write_vbi_from_user(itv,

		return ivtv_write_vbi_from_user(itv,

		   (const struct v4l2_sliced_vbi_data __user *)user_buf, elems);

		return elems * sizeof(struct v4l2_sliced_vbi_data);

	}



	mode = s->type == IVTV_DEC_STREAM_TYPE_MPG ? OUT_MPG : OUT_YUV;

drivers/media/video/ivtv/ivtv-vbi.c

+10 −4
Original line number Diff line number Diff line
@@ -157,7 +157,8 @@ static void ivtv_write_vbi(struct ivtv *itv, 
		ivtv_write_vbi_cc_lines(itv, &cc);

}



void ivtv_write_vbi_from_user(struct ivtv *itv,

ssize_t

ivtv_write_vbi_from_user(struct ivtv *itv,

			 const struct v4l2_sliced_vbi_data __user *sliced,

			 size_t cnt)

{
@@ -165,16 +166,21 @@ void ivtv_write_vbi_from_user(struct ivtv *itv, 
	int found_cc = 0;

	size_t i;

	struct v4l2_sliced_vbi_data d;

	ssize_t ret = cnt * sizeof(struct v4l2_sliced_vbi_data);



	for (i = 0; i < cnt; i++) {

		if (copy_from_user(&d, sliced + i,

				   sizeof(struct v4l2_sliced_vbi_data)))

				   sizeof(struct v4l2_sliced_vbi_data))) {

			ret = -EFAULT;

			break;

		}

		ivtv_write_vbi_line(itv, sliced + i, &cc, &found_cc);

	}



	if (found_cc)

		ivtv_write_vbi_cc_lines(itv, &cc);



	return ret;

}



static void copy_vbi_data(struct ivtv *itv, int lines, u32 pts_stamp)

drivers/media/video/ivtv/ivtv-vbi.h

+4 −3
Original line number Diff line number Diff line
@@ -20,7 +20,8 @@ 
#ifndef IVTV_VBI_H

#define IVTV_VBI_H



void ivtv_write_vbi_from_user(struct ivtv *itv,

ssize_t

ivtv_write_vbi_from_user(struct ivtv *itv,

			 const struct v4l2_sliced_vbi_data __user *sliced,

			 size_t count);

void ivtv_process_vbi_data(struct ivtv *itv, struct ivtv_buffer *buf,