cx24116: fix a buffer overflow when checking userspace params
[pandora-kernel.git] / drivers / media / media-device.c
1 /*
2  * Media device
3  *
4  * Copyright (C) 2010 Nokia Corporation
5  *
6  * Contacts: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
7  *           Sakari Ailus <sakari.ailus@iki.fi>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License version 2 as
11  * published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21  */
22
23 #include <linux/types.h>
24 #include <linux/ioctl.h>
25 #include <linux/media.h>
26 #include <linux/export.h>
27
28 #include <media/media-device.h>
29 #include <media/media-devnode.h>
30 #include <media/media-entity.h>
31
32 /* -----------------------------------------------------------------------------
33  * Userspace API
34  */
35
36 static int media_device_open(struct file *filp)
37 {
38         return 0;
39 }
40
41 static int media_device_close(struct file *filp)
42 {
43         return 0;
44 }
45
46 static int media_device_get_info(struct media_device *dev,
47                                  struct media_device_info __user *__info)
48 {
49         struct media_device_info info;
50
51         memset(&info, 0, sizeof(info));
52
53         strlcpy(info.driver, dev->dev->driver->name, sizeof(info.driver));
54         strlcpy(info.model, dev->model, sizeof(info.model));
55         strlcpy(info.serial, dev->serial, sizeof(info.serial));
56         strlcpy(info.bus_info, dev->bus_info, sizeof(info.bus_info));
57
58         info.media_version = MEDIA_API_VERSION;
59         info.hw_revision = dev->hw_revision;
60         info.driver_version = dev->driver_version;
61
62         return copy_to_user(__info, &info, sizeof(*__info));
63 }
64
65 static struct media_entity *find_entity(struct media_device *mdev, u32 id)
66 {
67         struct media_entity *entity;
68         int next = id & MEDIA_ENT_ID_FLAG_NEXT;
69
70         id &= ~MEDIA_ENT_ID_FLAG_NEXT;
71
72         spin_lock(&mdev->lock);
73
74         media_device_for_each_entity(entity, mdev) {
75                 if ((entity->id == id && !next) ||
76                     (entity->id > id && next)) {
77                         spin_unlock(&mdev->lock);
78                         return entity;
79                 }
80         }
81
82         spin_unlock(&mdev->lock);
83
84         return NULL;
85 }
86
87 static long media_device_enum_entities(struct media_device *mdev,
88                                        struct media_entity_desc __user *uent)
89 {
90         struct media_entity *ent;
91         struct media_entity_desc u_ent;
92
93         memset(&u_ent, 0, sizeof(u_ent));
94         if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
95                 return -EFAULT;
96
97         ent = find_entity(mdev, u_ent.id);
98
99         if (ent == NULL)
100                 return -EINVAL;
101
102         u_ent.id = ent->id;
103         u_ent.name[0] = '\0';
104         if (ent->name)
105                 strlcpy(u_ent.name, ent->name, sizeof(u_ent.name));
106         u_ent.type = ent->type;
107         u_ent.revision = ent->revision;
108         u_ent.flags = ent->flags;
109         u_ent.group_id = ent->group_id;
110         u_ent.pads = ent->num_pads;
111         u_ent.links = ent->num_links - ent->num_backlinks;
112         u_ent.v4l.major = ent->v4l.major;
113         u_ent.v4l.minor = ent->v4l.minor;
114         if (copy_to_user(uent, &u_ent, sizeof(u_ent)))
115                 return -EFAULT;
116         return 0;
117 }
118
119 static void media_device_kpad_to_upad(const struct media_pad *kpad,
120                                       struct media_pad_desc *upad)
121 {
122         upad->entity = kpad->entity->id;
123         upad->index = kpad->index;
124         upad->flags = kpad->flags;
125 }
126
127 static long media_device_enum_links(struct media_device *mdev,
128                                     struct media_links_enum __user *ulinks)
129 {
130         struct media_entity *entity;
131         struct media_links_enum links;
132
133         if (copy_from_user(&links, ulinks, sizeof(links)))
134                 return -EFAULT;
135
136         entity = find_entity(mdev, links.entity);
137         if (entity == NULL)
138                 return -EINVAL;
139
140         if (links.pads) {
141                 unsigned int p;
142
143                 for (p = 0; p < entity->num_pads; p++) {
144                         struct media_pad_desc pad;
145                         media_device_kpad_to_upad(&entity->pads[p], &pad);
146                         if (copy_to_user(&links.pads[p], &pad, sizeof(pad)))
147                                 return -EFAULT;
148                 }
149         }
150
151         if (links.links) {
152                 struct media_link_desc __user *ulink;
153                 unsigned int l;
154
155                 for (l = 0, ulink = links.links; l < entity->num_links; l++) {
156                         struct media_link_desc link;
157
158                         /* Ignore backlinks. */
159                         if (entity->links[l].source->entity != entity)
160                                 continue;
161
162                         media_device_kpad_to_upad(entity->links[l].source,
163                                                   &link.source);
164                         media_device_kpad_to_upad(entity->links[l].sink,
165                                                   &link.sink);
166                         link.flags = entity->links[l].flags;
167                         if (copy_to_user(ulink, &link, sizeof(*ulink)))
168                                 return -EFAULT;
169                         ulink++;
170                 }
171         }
172         if (copy_to_user(ulinks, &links, sizeof(*ulinks)))
173                 return -EFAULT;
174         return 0;
175 }
176
177 static long media_device_setup_link(struct media_device *mdev,
178                                     struct media_link_desc __user *_ulink)
179 {
180         struct media_link *link = NULL;
181         struct media_link_desc ulink;
182         struct media_entity *source;
183         struct media_entity *sink;
184         int ret;
185
186         if (copy_from_user(&ulink, _ulink, sizeof(ulink)))
187                 return -EFAULT;
188
189         /* Find the source and sink entities and link.
190          */
191         source = find_entity(mdev, ulink.source.entity);
192         sink = find_entity(mdev, ulink.sink.entity);
193
194         if (source == NULL || sink == NULL)
195                 return -EINVAL;
196
197         if (ulink.source.index >= source->num_pads ||
198             ulink.sink.index >= sink->num_pads)
199                 return -EINVAL;
200
201         link = media_entity_find_link(&source->pads[ulink.source.index],
202                                       &sink->pads[ulink.sink.index]);
203         if (link == NULL)
204                 return -EINVAL;
205
206         /* Setup the link on both entities. */
207         ret = __media_entity_setup_link(link, ulink.flags);
208
209         if (copy_to_user(_ulink, &ulink, sizeof(ulink)))
210                 return -EFAULT;
211
212         return ret;
213 }
214
215 static long media_device_ioctl(struct file *filp, unsigned int cmd,
216                                unsigned long arg)
217 {
218         struct media_devnode *devnode = media_devnode_data(filp);
219         struct media_device *dev = to_media_device(devnode);
220         long ret;
221
222         switch (cmd) {
223         case MEDIA_IOC_DEVICE_INFO:
224                 ret = media_device_get_info(dev,
225                                 (struct media_device_info __user *)arg);
226                 break;
227
228         case MEDIA_IOC_ENUM_ENTITIES:
229                 ret = media_device_enum_entities(dev,
230                                 (struct media_entity_desc __user *)arg);
231                 break;
232
233         case MEDIA_IOC_ENUM_LINKS:
234                 mutex_lock(&dev->graph_mutex);
235                 ret = media_device_enum_links(dev,
236                                 (struct media_links_enum __user *)arg);
237                 mutex_unlock(&dev->graph_mutex);
238                 break;
239
240         case MEDIA_IOC_SETUP_LINK:
241                 mutex_lock(&dev->graph_mutex);
242                 ret = media_device_setup_link(dev,
243                                 (struct media_link_desc __user *)arg);
244                 mutex_unlock(&dev->graph_mutex);
245                 break;
246
247         default:
248                 ret = -ENOIOCTLCMD;
249         }
250
251         return ret;
252 }
253
254 static const struct media_file_operations media_device_fops = {
255         .owner = THIS_MODULE,
256         .open = media_device_open,
257         .ioctl = media_device_ioctl,
258         .release = media_device_close,
259 };
260
261 /* -----------------------------------------------------------------------------
262  * sysfs
263  */
264
265 static ssize_t show_model(struct device *cd,
266                           struct device_attribute *attr, char *buf)
267 {
268         struct media_device *mdev = to_media_device(to_media_devnode(cd));
269
270         return sprintf(buf, "%.*s\n", (int)sizeof(mdev->model), mdev->model);
271 }
272
273 static DEVICE_ATTR(model, S_IRUGO, show_model, NULL);
274
275 /* -----------------------------------------------------------------------------
276  * Registration/unregistration
277  */
278
279 static void media_device_release(struct media_devnode *mdev)
280 {
281 }
282
283 /**
284  * media_device_register - register a media device
285  * @mdev:       The media device
286  *
287  * The caller is responsible for initializing the media device before
288  * registration. The following fields must be set:
289  *
290  * - dev must point to the parent device
291  * - model must be filled with the device model name
292  */
293 int __must_check media_device_register(struct media_device *mdev)
294 {
295         int ret;
296
297         if (WARN_ON(mdev->dev == NULL || mdev->model[0] == 0))
298                 return -EINVAL;
299
300         mdev->entity_id = 1;
301         INIT_LIST_HEAD(&mdev->entities);
302         spin_lock_init(&mdev->lock);
303         mutex_init(&mdev->graph_mutex);
304
305         /* Register the device node. */
306         mdev->devnode.fops = &media_device_fops;
307         mdev->devnode.parent = mdev->dev;
308         mdev->devnode.release = media_device_release;
309         ret = media_devnode_register(&mdev->devnode);
310         if (ret < 0)
311                 return ret;
312
313         ret = device_create_file(&mdev->devnode.dev, &dev_attr_model);
314         if (ret < 0) {
315                 media_devnode_unregister(&mdev->devnode);
316                 return ret;
317         }
318
319         return 0;
320 }
321 EXPORT_SYMBOL_GPL(media_device_register);
322
323 /**
324  * media_device_unregister - unregister a media device
325  * @mdev:       The media device
326  *
327  */
328 void media_device_unregister(struct media_device *mdev)
329 {
330         struct media_entity *entity;
331         struct media_entity *next;
332
333         list_for_each_entry_safe(entity, next, &mdev->entities, list)
334                 media_device_unregister_entity(entity);
335
336         device_remove_file(&mdev->devnode.dev, &dev_attr_model);
337         media_devnode_unregister(&mdev->devnode);
338 }
339 EXPORT_SYMBOL_GPL(media_device_unregister);
340
341 /**
342  * media_device_register_entity - Register an entity with a media device
343  * @mdev:       The media device
344  * @entity:     The entity
345  */
346 int __must_check media_device_register_entity(struct media_device *mdev,
347                                               struct media_entity *entity)
348 {
349         /* Warn if we apparently re-register an entity */
350         WARN_ON(entity->parent != NULL);
351         entity->parent = mdev;
352
353         spin_lock(&mdev->lock);
354         if (entity->id == 0)
355                 entity->id = mdev->entity_id++;
356         else
357                 mdev->entity_id = max(entity->id + 1, mdev->entity_id);
358         list_add_tail(&entity->list, &mdev->entities);
359         spin_unlock(&mdev->lock);
360
361         return 0;
362 }
363 EXPORT_SYMBOL_GPL(media_device_register_entity);
364
365 /**
366  * media_device_unregister_entity - Unregister an entity
367  * @entity:     The entity
368  *
369  * If the entity has never been registered this function will return
370  * immediately.
371  */
372 void media_device_unregister_entity(struct media_entity *entity)
373 {
374         struct media_device *mdev = entity->parent;
375
376         if (mdev == NULL)
377                 return;
378
379         spin_lock(&mdev->lock);
380         list_del(&entity->list);
381         spin_unlock(&mdev->lock);
382         entity->parent = NULL;
383 }
384 EXPORT_SYMBOL_GPL(media_device_unregister_entity);