Skip to content

Commit

Permalink
V4L/DVB (10920): v4l2-ioctl: fix partial-copy code.
Browse files Browse the repository at this point in the history
The code to optimize the usercopy only checked the ioctl NR field. However,
this code is also called for non-V4L2 ioctls (either private or ioctls from
linux/dvb/audio.h and linux/dvb/video.h for decoder drivers like ivtv).

If such an ioctl has the same NR as a V4L2 ioctl, then disaster strikes.

Modified the code to check on the full command ID.

Thanks to Martin Dauskardt for tracing the ivtv breakage to this particular
change.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  • Loading branch information
Hans Verkuil authored and Mauro Carvalho Chehab committed Mar 30, 2009
1 parent 501cd11 commit 9f1a693
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions drivers/media/video/v4l2-ioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -1796,11 +1796,12 @@ static long __video_do_ioctl(struct file *file,
static unsigned long cmd_input_size(unsigned int cmd)
{
/* Size of structure up to and including 'field' */
#define CMDINSIZE(cmd, type, field) case _IOC_NR(VIDIOC_##cmd): return \
offsetof(struct v4l2_##type, field) + \
sizeof(((struct v4l2_##type *)0)->field);
#define CMDINSIZE(cmd, type, field) \
case VIDIOC_##cmd: \
return offsetof(struct v4l2_##type, field) + \
sizeof(((struct v4l2_##type *)0)->field);

switch (_IOC_NR(cmd)) {
switch (cmd) {
CMDINSIZE(ENUM_FMT, fmtdesc, type);
CMDINSIZE(G_FMT, format, type);
CMDINSIZE(QUERYBUF, buffer, type);
Expand Down

0 comments on commit 9f1a693

Please sign in to comment.