Commit 3f65c6f6 authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Mauro Carvalho Chehab
Browse files

media: v4l2: allocate v4l2_clip objects early 



The v4l2_format based ioctls can have an indirect pointer to an array
of v4l2_clip structures for overlay mode, depending on the 'type' member.
There are only five drivers that use the overlay mode and copy the
data through the __user pointer.

Change the five drivers to use memcpy() instead, and copy the data
in common code using the check_array_args() helpers. This allows
for a subsequent patch that use the same mechanism for compat
ioctl handlers.

Note that there is another pointer for a 'bitmap' that is only
used in the 'vivid' driver and nowhere else. There is no easy
way to use the same trick without adding complexity to the
common code, so this remains a __user pointer.

[hverkuil: fix: CHECK: spaces preferred around that '*' (ctx:VxV)]
[hverkuil: fix: CHECK: Alignment should match open parenthesis]

Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 00af58fd

drivers/media/common/saa7146/saa7146_video.c

+2 −4
Original line number Diff line number Diff line
@@ -771,10 +771,8 @@ static int vidioc_s_fmt_vid_overlay(struct file *file, void *__fh, struct v4l2_f 
	vv->ov.nclips = f->fmt.win.clipcount;

	if (vv->ov.nclips > 16)

		vv->ov.nclips = 16;

	if (copy_from_user(vv->ov.clips, f->fmt.win.clips,

				sizeof(struct v4l2_clip) * vv->ov.nclips)) {

		return -EFAULT;

	}

	memcpy(vv->ov.clips, f->fmt.win.clips,

	       sizeof(struct v4l2_clip) * vv->ov.nclips);



	/* vv->ov.fh is used to indicate that we have valid overlay information, too */

	vv->ov.fh = fh;

drivers/media/pci/bt8xx/bttv-driver.c

+2 −6
Original line number Diff line number Diff line
@@ -2143,12 +2143,8 @@ static int setup_window_lock(struct bttv_fh *fh, struct bttv *btv, 
	clips = kmalloc(size,GFP_KERNEL);

	if (NULL == clips)

		return -ENOMEM;

	if (n > 0) {

		if (copy_from_user(clips,win->clips,sizeof(struct v4l2_clip)*n)) {

			kfree(clips);

			return -EFAULT;

		}

	}

	if (n > 0)

		memcpy(clips, win->clips, sizeof(struct v4l2_clip) * n);



	/* clip against screen */

	if (NULL != btv->fbuf.base)

drivers/media/pci/saa7134/saa7134-video.c

+7 −12
Original line number Diff line number Diff line
@@ -1265,9 +1265,7 @@ static int saa7134_g_fmt_vid_overlay(struct file *file, void *priv, 
				struct v4l2_format *f)

{

	struct saa7134_dev *dev = video_drvdata(file);

	struct v4l2_clip __user *clips = f->fmt.win.clips;

	u32 clipcount = f->fmt.win.clipcount;

	int err = 0;

	int i;



	if (saa7134_no_overlay > 0) {
@@ -1275,20 +1273,18 @@ static int saa7134_g_fmt_vid_overlay(struct file *file, void *priv, 
		return -EINVAL;

	}

	f->fmt.win = dev->win;

	f->fmt.win.clips = clips;

	if (clips == NULL)

	if (!f->fmt.win.clips)

		clipcount = 0;

	if (dev->nclips < clipcount)

		clipcount = dev->nclips;

	f->fmt.win.clipcount = clipcount;



	for (i = 0; !err && i < clipcount; i++) {

		if (copy_to_user(&f->fmt.win.clips[i].c, &dev->clips[i].c,

					sizeof(struct v4l2_rect)))

			err = -EFAULT;

	for (i = 0; i < clipcount; i++) {

		memcpy(&f->fmt.win.clips[i].c, &dev->clips[i].c,

		       sizeof(struct v4l2_rect));

	}



	return err;

	return 0;

}



static int saa7134_try_fmt_vid_cap(struct file *file, void *priv,
@@ -1396,9 +1392,8 @@ static int saa7134_s_fmt_vid_overlay(struct file *file, void *priv, 
	dev->win    = f->fmt.win;

	dev->nclips = f->fmt.win.clipcount;



	if (copy_from_user(dev->clips, f->fmt.win.clips,

			   sizeof(struct v4l2_clip) * dev->nclips))

		return -EFAULT;

	memcpy(dev->clips, f->fmt.win.clips,

	       sizeof(struct v4l2_clip) * dev->nclips);



	if (priv == dev->overlay_owner) {

		spin_lock_irqsave(&dev->slock, flags);

drivers/media/test-drivers/vivid/vivid-vid-cap.c

+7 −11
Original line number Diff line number Diff line
@@ -1107,11 +1107,9 @@ int vidioc_g_fmt_vid_overlay(struct file *file, void *priv, 
		    ((compose->width + 7) / 8) * compose->height))

			return -EFAULT;

	}

	if (clipcount && win->clips) {

		if (copy_to_user(win->clips, dev->clips_cap,

				 clipcount * sizeof(dev->clips_cap[0])))

			return -EFAULT;

	}

	if (clipcount && win->clips)

		memcpy(win->clips, dev->clips_cap,

		       clipcount * sizeof(dev->clips_cap[0]));

	return 0;

}
@@ -1141,9 +1139,8 @@ int vidioc_try_fmt_vid_overlay(struct file *file, void *priv, 
	if (win->clipcount > MAX_CLIPS)

		win->clipcount = MAX_CLIPS;

	if (win->clipcount) {

		if (copy_from_user(dev->try_clips_cap, win->clips,

				   win->clipcount * sizeof(dev->clips_cap[0])))

			return -EFAULT;

		memcpy(dev->try_clips_cap, win->clips,

		       win->clipcount * sizeof(dev->clips_cap[0]));

		for (i = 0; i < win->clipcount; i++) {

			struct v4l2_rect *r = &dev->try_clips_cap[i].c;
@@ -1166,9 +1163,8 @@ int vidioc_try_fmt_vid_overlay(struct file *file, void *priv, 
					return -EINVAL;

			}

		}

		if (copy_to_user(win->clips, dev->try_clips_cap,

				 win->clipcount * sizeof(dev->clips_cap[0])))

			return -EFAULT;

		memcpy(win->clips, dev->try_clips_cap,

		       win->clipcount * sizeof(dev->clips_cap[0]));

	}

	return 0;

}

drivers/media/test-drivers/vivid/vivid-vid-out.c

+7 −11
Original line number Diff line number Diff line
@@ -857,11 +857,9 @@ int vidioc_g_fmt_vid_out_overlay(struct file *file, void *priv, 
		    ((dev->compose_out.width + 7) / 8) * dev->compose_out.height))

			return -EFAULT;

	}

	if (clipcount && win->clips) {

		if (copy_to_user(win->clips, dev->clips_out,

				 clipcount * sizeof(dev->clips_out[0])))

			return -EFAULT;

	}

	if (clipcount && win->clips)

		memcpy(win->clips, dev->clips_out,

		       clipcount * sizeof(dev->clips_out[0]));

	return 0;

}
@@ -891,9 +889,8 @@ int vidioc_try_fmt_vid_out_overlay(struct file *file, void *priv, 
	if (win->clipcount > MAX_CLIPS)

		win->clipcount = MAX_CLIPS;

	if (win->clipcount) {

		if (copy_from_user(dev->try_clips_out, win->clips,

				   win->clipcount * sizeof(dev->clips_out[0])))

			return -EFAULT;

		memcpy(dev->try_clips_out, win->clips,

		       win->clipcount * sizeof(dev->clips_out[0]));

		for (i = 0; i < win->clipcount; i++) {

			struct v4l2_rect *r = &dev->try_clips_out[i].c;
@@ -916,9 +913,8 @@ int vidioc_try_fmt_vid_out_overlay(struct file *file, void *priv, 
					return -EINVAL;

			}

		}

		if (copy_to_user(win->clips, dev->try_clips_out,

				 win->clipcount * sizeof(dev->clips_out[0])))

			return -EFAULT;

		memcpy(win->clips, dev->try_clips_out,

		       win->clipcount * sizeof(dev->clips_out[0]));

	}

	return 0;

}