From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0102.outbound.protection.outlook.com ([104.47.36.102]:5120 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032408AbeCAPeo (ORCPT ); Thu, 1 Mar 2018 10:34:44 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [added to the 4.1 stable tree] media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer Date: Thu, 1 Mar 2018 15:26:09 +0000 Message-ID: <20180301152116.1486-338-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Hans Verkuil This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit b8c601e8af2d08f733d74defa8465303391bb930 ] ctrl_is_pointer just hardcoded two known string controls, but that caused problems when using e.g. custom controls that use a pointer for the payload. Reimplement this function: it now finds the v4l2_ctrl (if the driver uses the control framework) or it calls vidioc_query_ext_ctrl (if the driver implements that directly). In both cases it can now check if the control is a pointer control or not. Signed-off-by: Hans Verkuil Acked-by: Sakari Ailus Cc: # for v4.15 and up Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 57 ++++++++++++++++++-----= ---- 1 file changed, 38 insertions(+), 19 deletions(-) diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/= v4l2-core/v4l2-compat-ioctl32.c index 42d402948ea2..4bbbfc34d4e5 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -18,6 +18,8 @@ #include #include #include +#include +#include #include =20 static long native_ioctl(struct file *file, unsigned int cmd, unsigned lon= g arg) @@ -623,24 +625,39 @@ struct v4l2_ext_control32 { }; } __attribute__ ((packed)); =20 -/* The following function really belong in v4l2-common, but that causes - a circular dependency between modules. We need to think about this, but - for now this will do. */ - -/* Return non-zero if this control is a pointer type. Currently only - type STRING is a pointer type. */ -static inline int ctrl_is_pointer(u32 id) +/* Return true if this control is a pointer type. */ +static inline bool ctrl_is_pointer(struct file *file, u32 id) { - switch (id) { - case V4L2_CID_RDS_TX_PS_NAME: - case V4L2_CID_RDS_TX_RADIO_TEXT: - return 1; - default: - return 0; + struct video_device *vdev =3D video_devdata(file); + struct v4l2_fh *fh =3D NULL; + struct v4l2_ctrl_handler *hdl =3D NULL; + struct v4l2_query_ext_ctrl qec =3D { id }; + const struct v4l2_ioctl_ops *ops =3D vdev->ioctl_ops; + + if (test_bit(V4L2_FL_USES_V4L2_FH, &vdev->flags)) + fh =3D file->private_data; + + if (fh && fh->ctrl_handler) + hdl =3D fh->ctrl_handler; + else if (vdev->ctrl_handler) + hdl =3D vdev->ctrl_handler; + + if (hdl) { + struct v4l2_ctrl *ctrl =3D v4l2_ctrl_find(hdl, id); + + return ctrl && ctrl->is_ptr; } + + if (!ops->vidioc_query_ext_ctrl) + return false; + + return !ops->vidioc_query_ext_ctrl(file, fh, &qec) && + (qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD); } =20 -static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4= l2_ext_controls32 __user *up) +static int get_v4l2_ext_controls32(struct file *file, + struct v4l2_ext_controls *kp, + struct v4l2_ext_controls32 __user *up) { struct v4l2_ext_control32 __user *ucontrols; struct v4l2_ext_control __user *kcontrols; @@ -673,7 +690,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_cont= rols *kp, struct v4l2_ext return -EFAULT; if (get_user(id, &kcontrols->id)) return -EFAULT; - if (ctrl_is_pointer(id)) { + if (ctrl_is_pointer(file, id)) { void __user *s; =20 if (get_user(p, &ucontrols->string)) @@ -688,7 +705,9 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_cont= rols *kp, struct v4l2_ext return 0; } =20 -static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4= l2_ext_controls32 __user *up) +static int put_v4l2_ext_controls32(struct file *file, + struct v4l2_ext_controls *kp, + struct v4l2_ext_controls32 __user *up) { struct v4l2_ext_control32 __user *ucontrols; struct v4l2_ext_control __user *kcontrols =3D @@ -721,7 +740,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_cont= rols *kp, struct v4l2_ext /* Do not modify the pointer when copying a pointer control. The contents of the pointer was changed, not the pointer itself. */ - if (ctrl_is_pointer(id)) + if (ctrl_is_pointer(file, id)) size -=3D sizeof(ucontrols->value64); if (copy_in_user(ucontrols, kcontrols, size)) return -EFAULT; @@ -934,7 +953,7 @@ static long do_video_ioctl(struct file *file, unsigned = int cmd, unsigned long ar case VIDIOC_G_EXT_CTRLS: case VIDIOC_S_EXT_CTRLS: case VIDIOC_TRY_EXT_CTRLS: - err =3D get_v4l2_ext_controls32(&karg.v2ecs, up); + err =3D get_v4l2_ext_controls32(file, &karg.v2ecs, up); compatible_arg =3D 0; break; case VIDIOC_DQEVENT: @@ -961,7 +980,7 @@ static long do_video_ioctl(struct file *file, unsigned = int cmd, unsigned long ar case VIDIOC_G_EXT_CTRLS: case VIDIOC_S_EXT_CTRLS: case VIDIOC_TRY_EXT_CTRLS: - if (put_v4l2_ext_controls32(&karg.v2ecs, up)) + if (put_v4l2_ext_controls32(file, &karg.v2ecs, up)) err =3D -EFAULT; break; } --=20 2.14.1