|
|
@@ -328,7 +328,7 @@ struct v4l2_buffer32 {
|
|
|
__u32 reserved;
|
|
|
};
|
|
|
|
|
|
-static int get_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
|
|
|
+static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
|
|
|
enum v4l2_memory memory)
|
|
|
{
|
|
|
void __user *up_pln;
|
|
|
@@ -357,7 +357,7 @@ static int get_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
-static int put_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
|
|
|
+static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
|
|
|
enum v4l2_memory memory)
|
|
|
{
|
|
|
if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
|
|
|
@@ -427,7 +427,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|
|
* by passing a very big num_planes value */
|
|
|
uplane = compat_alloc_user_space(num_planes *
|
|
|
sizeof(struct v4l2_plane));
|
|
|
- kp->m.planes = uplane;
|
|
|
+ kp->m.planes = (__force struct v4l2_plane *)uplane;
|
|
|
|
|
|
while (--num_planes >= 0) {
|
|
|
ret = get_v4l2_plane32(uplane, uplane32, kp->memory);
|
|
|
@@ -498,7 +498,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
|
|
|
if (num_planes == 0)
|
|
|
return 0;
|
|
|
|
|
|
- uplane = kp->m.planes;
|
|
|
+ uplane = (__force struct v4l2_plane __user *)kp->m.planes;
|
|
|
if (get_user(p, &up->m.planes))
|
|
|
return -EFAULT;
|
|
|
uplane32 = compat_ptr(p);
|
|
|
@@ -562,7 +562,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
|
|
|
get_user(kp->flags, &up->flags) ||
|
|
|
copy_from_user(&kp->fmt, &up->fmt, sizeof(up->fmt)))
|
|
|
return -EFAULT;
|
|
|
- kp->base = compat_ptr(tmp);
|
|
|
+ kp->base = (__force void *)compat_ptr(tmp);
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
@@ -667,11 +667,15 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|
|
n * sizeof(struct v4l2_ext_control32)))
|
|
|
return -EFAULT;
|
|
|
kcontrols = compat_alloc_user_space(n * sizeof(struct v4l2_ext_control));
|
|
|
- kp->controls = kcontrols;
|
|
|
+ kp->controls = (__force struct v4l2_ext_control *)kcontrols;
|
|
|
while (--n >= 0) {
|
|
|
+ u32 id;
|
|
|
+
|
|
|
if (copy_in_user(kcontrols, ucontrols, sizeof(*ucontrols)))
|
|
|
return -EFAULT;
|
|
|
- if (ctrl_is_pointer(kcontrols->id)) {
|
|
|
+ if (get_user(id, &kcontrols->id))
|
|
|
+ return -EFAULT;
|
|
|
+ if (ctrl_is_pointer(id)) {
|
|
|
void __user *s;
|
|
|
|
|
|
if (get_user(p, &ucontrols->string))
|
|
|
@@ -689,7 +693,8 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|
|
static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up)
|
|
|
{
|
|
|
struct v4l2_ext_control32 __user *ucontrols;
|
|
|
- struct v4l2_ext_control __user *kcontrols = kp->controls;
|
|
|
+ struct v4l2_ext_control __user *kcontrols =
|
|
|
+ (__force struct v4l2_ext_control __user *)kp->controls;
|
|
|
int n = kp->count;
|
|
|
compat_caddr_t p;
|
|
|
|
|
|
@@ -711,11 +716,14 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
|
|
|
|
|
|
while (--n >= 0) {
|
|
|
unsigned size = sizeof(*ucontrols);
|
|
|
+ u32 id;
|
|
|
|
|
|
+ if (get_user(id, &kcontrols->id))
|
|
|
+ return -EFAULT;
|
|
|
/* Do not modify the pointer when copying a pointer control.
|
|
|
The contents of the pointer was changed, not the pointer
|
|
|
itself. */
|
|
|
- if (ctrl_is_pointer(kcontrols->id))
|
|
|
+ if (ctrl_is_pointer(id))
|
|
|
size -= sizeof(ucontrols->value64);
|
|
|
if (copy_in_user(ucontrols, kcontrols, size))
|
|
|
return -EFAULT;
|
|
|
@@ -770,7 +778,7 @@ static int get_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up)
|
|
|
get_user(tmp, &up->edid) ||
|
|
|
copy_from_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
|
|
|
return -EFAULT;
|
|
|
- kp->edid = compat_ptr(tmp);
|
|
|
+ kp->edid = (__force u8 *)compat_ptr(tmp);
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
@@ -783,7 +791,7 @@ static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up)
|
|
|
put_user(kp->start_block, &up->start_block) ||
|
|
|
put_user(kp->blocks, &up->blocks) ||
|
|
|
put_user(tmp, &up->edid) ||
|
|
|
- copy_to_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
|
|
|
+ copy_to_user(up->reserved, kp->reserved, sizeof(up->reserved)))
|
|
|
return -EFAULT;
|
|
|
return 0;
|
|
|
}
|
Hans Verkuil