summaryrefslogtreecommitdiffstats
path: root/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2014-05-21 19:01:08 +0900
committerLinus Torvalds <torvalds@linux-foundation.org>2014-05-21 19:01:08 +0900
commitfba69f042ad99f68c0268ef1c012f3199f898fac (patch)
treea64ff64b909e0c239858f3fd1d8ccaa00d010e99 /drivers/media/v4l2-core/v4l2-compat-ioctl32.c
parent84e12d992a54bc64590989b50d292e510a7d73cd (diff)
parent97d9d23dda6f37d90aefeec4ed619d52df525382 (diff)
Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab: "Most of the changes are drivers fixes (rtl28xuu, fc2580, ov7670, davinci, gspca, s5p-fimc and s5c73m3). There is also a compat32 fix and one infoleak fixup at the media controller" * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] V4L2: fix VIDIOC_CREATE_BUFS in 64- / 32-bit compatibility mode [media] V4L2: ov7670: fix a wrong index, potentially Oopsing the kernel from user-space [media] media-device: fix infoleak in ioctl media_enum_entities() [media] fc2580: fix tuning failure on 32-bit arch [media] Prefer gspca_sonixb over sn9c102 for all devices [media] media: davinci: vpfe: make sure all the buffers unmapped and released [media] staging: media: davinci: vpfe: make sure all the buffers are released [media] media: davinci: vpbe_display: fix releasing of active buffers [media] media: davinci: vpif_display: fix releasing of active buffers [media] media: davinci: vpif_capture: fix releasing of active buffers [media] s5p-fimc: Fix YUV422P depth [media] s5c73m3: Add missing rename of v4l2_of_get_next_endpoint() function [media] rtl28xxu: silence error log about disabled rtl2832_sdr module [media] rtl28xxu: do not hard depend on staging SDR module
Diffstat (limited to 'drivers/media/v4l2-core/v4l2-compat-ioctl32.c')
-rw-r--r--drivers/media/v4l2-core/v4l2-compat-ioctl32.c12
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 04b2daf567b..7e2411c3641 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
{
+ if (get_user(kp->type, &up->type))
+ return -EFAULT;
+
switch (kp->type) {
case V4L2_BUF_TYPE_VIDEO_CAPTURE:
case V4L2_BUF_TYPE_VIDEO_OUTPUT:
@@ -204,17 +207,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
{
- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
- get_user(kp->type, &up->type))
- return -EFAULT;
+ if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
+ return -EFAULT;
return __get_v4l2_format32(kp, up);
}
static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
{
if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
- copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
- return -EFAULT;
+ copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
+ return -EFAULT;
return __get_v4l2_format32(&kp->format, &up->format);
}