Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac9575f7 authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (10625): ivtv: fix decoder crash regression 



The video_ioctl2 conversion of ivtv in kernel 2.6.27 introduced a bug
causing decoder commands to crash. The decoder commands should have been
handled from the video_ioctl2 default handler, ensuring correct mapping
of the argument between user and kernel space. Unfortunately they ended
up before the video_ioctl2 call, causing random crashes.

Thanks to hannes@linus.priv.at for testing and helping me track down the
cause!

Signed-off-by: default avatarHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent ad28127d

drivers/media/video/ivtv/ivtv-ioctl.c

+12 −12
Original line number Original line Diff line number Diff line
@@ -1748,6 +1748,18 @@ static long ivtv_default(struct file *file, void *fh, int cmd, void *arg) 
		break;

		break;

	}

	}





	case IVTV_IOC_DMA_FRAME:

	case VIDEO_GET_PTS:

	case VIDEO_GET_FRAME_COUNT:

	case VIDEO_GET_EVENT:

	case VIDEO_PLAY:

	case VIDEO_STOP:

	case VIDEO_FREEZE:

	case VIDEO_CONTINUE:

	case VIDEO_COMMAND:

	case VIDEO_TRY_COMMAND:

		return ivtv_decoder_ioctls(file, cmd, (void *)arg);



	default:

	default:

		return -EINVAL;

		return -EINVAL;

	}

	}
@@ -1790,18 +1802,6 @@ static long ivtv_serialized_ioctl(struct ivtv *itv, struct file *filp, 
		ivtv_vapi(itv, CX2341X_DEC_SET_AUDIO_MODE, 2, itv->audio_bilingual_mode, itv->audio_stereo_mode);

		ivtv_vapi(itv, CX2341X_DEC_SET_AUDIO_MODE, 2, itv->audio_bilingual_mode, itv->audio_stereo_mode);

		return 0;

		return 0;





	case IVTV_IOC_DMA_FRAME:

	case VIDEO_GET_PTS:

	case VIDEO_GET_FRAME_COUNT:

	case VIDEO_GET_EVENT:

	case VIDEO_PLAY:

	case VIDEO_STOP:

	case VIDEO_FREEZE:

	case VIDEO_CONTINUE:

	case VIDEO_COMMAND:

	case VIDEO_TRY_COMMAND:

		return ivtv_decoder_ioctls(filp, cmd, (void *)arg);



	default:

	default:

		break;

		break;

	}

	}