Re: [PATCH] [media] media/core: copy user v4l2_buffer.length in DMABUF case

[Hans Verkuil <hverkuil@xs4all.nl>]

Has already been fixed.

But thanks anyway :-)

Regards,

	Hans

On 02/17/16 11:47, Kevin Grandemange wrote:
> in __qbuf_dmabuf, we check the dmabuf size against the plane size.
> 
> In the monoplanar case, this length was not copied from the userspace
> and we were getting a random value.
> 
> Signed-off-by: Kevin Grandemange <grandemange.kevin@gmail.com>
> ---
>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 8fd84a6..af0e01c 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -482,7 +482,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
>  				return -EFAULT;
>  			break;
>  		case V4L2_MEMORY_DMABUF:
> -			if (get_user(kp->m.fd, &up->m.fd))
> +			if (get_user(kp->length, &up->length) ||
> +			    get_user(kp->m.fd, &up->m.fd))
>  				return -EFAULT;
>  			break;
>  		}
>