media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32

commit 8ed5a59dcb47a6f76034ee760b36e089f3e82529 upstream.

The struct v4l2_plane32 should set m.userptr as well. The same
happens in v4l2_buffer32 and v4l2-compliance tests for this.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 1ea8b81..1cde4c5 100644 (file)
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -296,16 +296,20 @@ static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __
                         sizeof(up->data_offset)))
                return -EFAULT;
 
                         sizeof(up->data_offset)))
                return -EFAULT;
 

-       if (memory == V4L2_MEMORY_USERPTR) {
+       switch (memory) {
+       case V4L2_MEMORY_MMAP:
+       case V4L2_MEMORY_OVERLAY:
+               if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
+                                sizeof(up32->m.mem_offset)))
+                       return -EFAULT;
+               break;
+       case V4L2_MEMORY_USERPTR:

                if (get_user(p, &up32->m.userptr))
                        return -EFAULT;
                up_pln = compat_ptr(p);
                if (put_user((unsigned long)up_pln, &up->m.userptr))
                        return -EFAULT;
                if (get_user(p, &up32->m.userptr))
                        return -EFAULT;
                up_pln = compat_ptr(p);
                if (put_user((unsigned long)up_pln, &up->m.userptr))
                        return -EFAULT;

-       } else {
-               if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
-                                sizeof(up32->m.mem_offset)))
-                       return -EFAULT;
+               break;

        }
 
        return 0;
        }
 
        return 0;


@@ -314,17 +318,27 @@ static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __
 static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
                            enum v4l2_memory memory)
 {
 static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
                            enum v4l2_memory memory)
 {

+       unsigned long p;
+

        if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
            copy_in_user(&up32->data_offset, &up->data_offset,
                         sizeof(up->data_offset)))
                return -EFAULT;
 
        if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
            copy_in_user(&up32->data_offset, &up->data_offset,
                         sizeof(up->data_offset)))
                return -EFAULT;
 

-       /* For MMAP, driver might've set up the offset, so copy it back.
-        * USERPTR stays the same (was userspace-provided), so no copying. */
-       if (memory == V4L2_MEMORY_MMAP)
+       switch (memory) {
+       case V4L2_MEMORY_MMAP:
+       case V4L2_MEMORY_OVERLAY:

                if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
                                 sizeof(up->m.mem_offset)))
                        return -EFAULT;
                if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
                                 sizeof(up->m.mem_offset)))
                        return -EFAULT;

+               break;
+       case V4L2_MEMORY_USERPTR:
+               if (get_user(p, &up->m.userptr) ||
+                   put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
+                            &up32->m.userptr))
+                       return -EFAULT;
+               break;
+       }

 
        return 0;
 }
 
        return 0;
 }