From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225/KNK/6X1yUvfpByT6JKt1PrTzzRcH79xrMJjNtU6USmWj0P1Wi9IkiM3kszFyIhoyMok3 ARC-Seal: i=1; a=rsa-sha256; t=1518709018; cv=none; d=google.com; s=arc-20160816; b=StoFW3heX8yUfk/aTeRfwp1FWPuO8aUxGtAzcKlkP1Iq0zoEnQfNivbLAaXOH1J+ug 76yoB1K9h0xx36mt5TV6htQxFREPso46+XFbrkCiNQYOGsgBWajYYae9m5t10JzmNns9 r7HK9ASvtxraBLbl7XRIlKOYf0HGb594WgXTE9nhCW5pY6dNtw8Z0S6tvK2bdkueJUiI JjSdzbZFCqOezVTaF1pxPADvsJrQzUdsQ3ahlNo/K96g2YPLETf4KqVvBnpQu1h+jCci jMT7tnud6DcN+0bGmiVy9t1GNRBKHmhS3Rj2DmV4c2JWCCXlPlV4cMnLhviGSKEEPXq/ BoOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=qnYge3TSczkvc/ruinnPaxfioELKS2rakYUoB94tRAQ=; b=apfSkfBCn/PkZrwvP8CXbNis5B/KG0OrEzMhPXF+Xwj4zFlvL75Nmr/Ldm4HvqWN7B PMilaPPfn9se44+frgevRe2akah48N+LafW3QERgmDXr72FSkXPXx39gHU3l9KrgEUXE /S51XQeR2T2WcatZThNn4OWQh5jbpDXJ/DQSG6IHuUT0+Z4C86N9RRl4bkdp66fqKK/s 6OWiJPAf/3T/VdgtupQVVQxW/faljTQ7DdqDO1QcBNQpsgVioPGrnesQTxp/iSadGt26 4aeEs/ZrZkIAJGNIvRlJZbqdc/sGPwNJfKPgC3Ax0JZQO3J7beGqqaUqzVniMJFFqlj8 MB/w== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Hans Verkuil , Sakari Ailus , Mauro Carvalho Chehab Subject: [PATCH 4.14 128/195] media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 Date: Thu, 15 Feb 2018 16:16:59 +0100 Message-Id: <20180215151712.151842648@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180215151705.738773577@linuxfoundation.org> References: <20180215151705.738773577@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1592481020362499482?= X-GMAIL-MSGID: =?utf-8?q?1592481827454319443?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hans Verkuil commit a751be5b142ef6bcbbb96d9899516f4d9c8d0ef4 upstream. put_v4l2_window32() didn't copy back the clip list to userspace. Drivers can update the clip rectangles, so this should be done. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 59 +++++++++++++++++--------- 1 file changed, 40 insertions(+), 19 deletions(-) --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -50,6 +50,11 @@ struct v4l2_window32 { static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) { + struct v4l2_clip32 __user *uclips; + struct v4l2_clip __user *kclips; + compat_caddr_t p; + u32 n; + if (!access_ok(VERIFY_READ, up, sizeof(*up)) || copy_from_user(&kp->w, &up->w, sizeof(up->w)) || get_user(kp->field, &up->field) || @@ -59,38 +64,54 @@ static int get_v4l2_window32(struct v4l2 return -EFAULT; if (kp->clipcount > 2048) return -EINVAL; - if (kp->clipcount) { - struct v4l2_clip32 __user *uclips; - struct v4l2_clip __user *kclips; - int n = kp->clipcount; - compat_caddr_t p; + if (!kp->clipcount) { + kp->clips = NULL; + return 0; + } - if (get_user(p, &up->clips)) + n = kp->clipcount; + if (get_user(p, &up->clips)) + return -EFAULT; + uclips = compat_ptr(p); + kclips = compat_alloc_user_space(n * sizeof(*kclips)); + kp->clips = kclips; + while (n--) { + if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) return -EFAULT; - uclips = compat_ptr(p); - kclips = compat_alloc_user_space(n * sizeof(*kclips)); - kp->clips = kclips; - while (--n >= 0) { - if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) - return -EFAULT; - if (put_user(n ? kclips + 1 : NULL, &kclips->next)) - return -EFAULT; - uclips += 1; - kclips += 1; - } - } else - kp->clips = NULL; + if (put_user(n ? kclips + 1 : NULL, &kclips->next)) + return -EFAULT; + uclips++; + kclips++; + } return 0; } static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) { + struct v4l2_clip __user *kclips = kp->clips; + struct v4l2_clip32 __user *uclips; + u32 n = kp->clipcount; + compat_caddr_t p; + if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) || put_user(kp->field, &up->field) || put_user(kp->chromakey, &up->chromakey) || put_user(kp->clipcount, &up->clipcount) || put_user(kp->global_alpha, &up->global_alpha)) return -EFAULT; + + if (!kp->clipcount) + return 0; + + if (get_user(p, &up->clips)) + return -EFAULT; + uclips = compat_ptr(p); + while (n--) { + if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c))) + return -EFAULT; + uclips++; + kclips++; + } return 0; }