media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32

commit a751be5b142ef6bcbbb96d9899516f4d9c8d0ef4 upstream.

put_v4l2_window32() didn't copy back the clip list to userspace.
Drivers can update the clip rectangles, so this should be done.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 8fb6b74..a243746 100644 (file)
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -51,6 +51,11 @@ struct v4l2_window32 {
 
 static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
 {
+       struct v4l2_clip32 __user *uclips;
+       struct v4l2_clip __user *kclips;
+       compat_caddr_t p;
+       u32 n;
+
        if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
            copy_from_user(&kp->w, &up->w, sizeof(up->w)) ||
            get_user(kp->field, &up->field) ||
@@ -60,38 +65,54 @@ static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
                return -EFAULT;
        if (kp->clipcount > 2048)
                return -EINVAL;
-       if (kp->clipcount) {
-               struct v4l2_clip32 __user *uclips;
-               struct v4l2_clip __user *kclips;
-               int n = kp->clipcount;
-               compat_caddr_t p;
+       if (!kp->clipcount) {
+               kp->clips = NULL;
+               return 0;
+       }
 
-               if (get_user(p, &up->clips))
+       n = kp->clipcount;
+       if (get_user(p, &up->clips))
+               return -EFAULT;
+       uclips = compat_ptr(p);
+       kclips = compat_alloc_user_space(n * sizeof(*kclips));
+       kp->clips = kclips;
+       while (n--) {
+               if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
                        return -EFAULT;
-               uclips = compat_ptr(p);
-               kclips = compat_alloc_user_space(n * sizeof(*kclips));
-               kp->clips = kclips;
-               while (--n >= 0) {
-                       if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
-                               return -EFAULT;
-                       if (put_user(n ? kclips + 1 : NULL, &kclips->next))
-                               return -EFAULT;
-                       uclips += 1;
-                       kclips += 1;
-               }
-       } else
-               kp->clips = NULL;
+               if (put_user(n ? kclips + 1 : NULL, &kclips->next))
+                       return -EFAULT;
+               uclips++;
+               kclips++;
+       }
        return 0;
 }
 
 static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
 {
+       struct v4l2_clip __user *kclips = kp->clips;
+       struct v4l2_clip32 __user *uclips;
+       u32 n = kp->clipcount;
+       compat_caddr_t p;
+
        if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) ||
            put_user(kp->field, &up->field) ||
            put_user(kp->chromakey, &up->chromakey) ||
            put_user(kp->clipcount, &up->clipcount) ||
            put_user(kp->global_alpha, &up->global_alpha))
                return -EFAULT;
+
+       if (!kp->clipcount)
+               return 0;
+
+       if (get_user(p, &up->clips))
+               return -EFAULT;
+       uclips = compat_ptr(p);
+       while (n--) {
+               if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c)))
+                       return -EFAULT;
+               uclips++;
+               kclips++;
+       }
        return 0;
 }