Re: [PATCH] v4l: Fix dma buf single plane compat handling

2015-12-13 Thread Laurent Pinchart 
Hi Sakari,

On Wednesday 09 December 2015 13:07:40 Sakari Ailus wrote:
> On Wed, Dec 09, 2015 at 01:11:12AM +0200, Laurent Pinchart wrote:
> > On Tuesday 08 December 2015 17:29:16 Sakari Ailus wrote:
> > > On Mon, Dec 07, 2015 at 10:45:39AM +0200, Laurent Pinchart wrote:
> > > > From: Gjorgji Rosikopulos 
> > > > 
> > > > Buffer length is needed for single plane as well, otherwise
> > > > is uninitialized and behaviour is undetermined.
> > > 
> > > How about:
> > > 
> > > The v4l2_buffer length field must be passed as well from user to kernel
> > > and back, otherwise uninitialised values will be used.
> > > 
> > > > Signed-off-by: Gjorgji Rosikopulos 
> > > > Signed-off-by: Laurent Pinchart 
> > > 
> > > Acked-by: Sakari Ailus 
> > > 
> > > Shouldn't this be submitted to stable as well?
> > 
> > I'll CC stable.
> > 
> > > > ---
> > > > 
> > > >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 7 +--
> > > >  1 file changed, 5 insertions(+), 2 deletions(-)
> > > > 
> > > > diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > > > b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index
> > > > 8fd84a67478a..b0faa1f7e3a9 100644
> > > > --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > > > +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > > > @@ -482,8 +482,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer
> > > > *kp, struct v4l2_buffer32 __user
> > > > return -EFAULT;
> > > > break;
> > > > 
> > > > case V4L2_MEMORY_DMABUF:
> > > > -   if (get_user(kp->m.fd, >m.fd))
> > > > +   if (get_user(kp->m.fd, >m.fd) ||
> > > > +   get_user(kp->length, >length))
> > > > return -EFAULT;
> > > > +
> 
> Without the extra newline, please?

Sure, I'll fix that in the pull request.

-- 
Regards,

Laurent Pinchart

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] v4l: Fix dma buf single plane compat handling

2015-12-09 Thread Sakari Ailus 
On Wed, Dec 09, 2015 at 01:11:12AM +0200, Laurent Pinchart wrote:
> Hi Sakari,
> 
> On Tuesday 08 December 2015 17:29:16 Sakari Ailus wrote:
> > On Mon, Dec 07, 2015 at 10:45:39AM +0200, Laurent Pinchart wrote:
> > > From: Gjorgji Rosikopulos 
> > > 
> > > Buffer length is needed for single plane as well, otherwise
> > > is uninitialized and behaviour is undetermined.
> > 
> > How about:
> > 
> > The v4l2_buffer length field must be passed as well from user to kernel and
> > back, otherwise uninitialised values will be used.
> > 
> > > Signed-off-by: Gjorgji Rosikopulos 
> > > Signed-off-by: Laurent Pinchart 
> > 
> > Acked-by: Sakari Ailus 
> > 
> > Shouldn't this be submitted to stable as well?
> 
> I'll CC stable.
> 
> > > ---
> > > 
> > >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 7 +--
> > >  1 file changed, 5 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > > b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index
> > > 8fd84a67478a..b0faa1f7e3a9 100644
> > > --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > > +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > > @@ -482,8 +482,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp,
> > > struct v4l2_buffer32 __user> 
> > >   return -EFAULT;
> > >   
> > >   break;
> > >   
> > >   case V4L2_MEMORY_DMABUF:
> > > - if (get_user(kp->m.fd, >m.fd))
> > > + if (get_user(kp->m.fd, >m.fd) ||
> > > + get_user(kp->length, >length))
> > > 
> > >   return -EFAULT;
> > > 
> > > +

Without the extra newline, please?

-- 
Sakari Ailus
e-mail: sakari.ai...@iki.fi XMPP: sai...@retiisi.org.uk
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] v4l: Fix dma buf single plane compat handling

2015-12-08 Thread Sakari Ailus 
Hi Laurent and Gjorgji,

On Mon, Dec 07, 2015 at 10:45:39AM +0200, Laurent Pinchart wrote:
> From: Gjorgji Rosikopulos 
> 
> Buffer length is needed for single plane as well, otherwise
> is uninitialized and behaviour is undetermined.

How about:

The v4l2_buffer length field must be passed as well from user to kernel and
back, otherwise uninitialised values will be used.

> 
> Signed-off-by: Gjorgji Rosikopulos 
> Signed-off-by: Laurent Pinchart 

Acked-by: Sakari Ailus 

Shouldn't this be submitted to stable as well?

> ---
>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 7 +--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c 
> b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 8fd84a67478a..b0faa1f7e3a9 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -482,8 +482,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, 
> struct v4l2_buffer32 __user
>   return -EFAULT;
>   break;
>   case V4L2_MEMORY_DMABUF:
> - if (get_user(kp->m.fd, >m.fd))
> + if (get_user(kp->m.fd, >m.fd) ||
> + get_user(kp->length, >length))
>   return -EFAULT;
> +
>   break;
>   }
>   }
> @@ -550,7 +552,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, 
> struct v4l2_buffer32 __user
>   return -EFAULT;
>   break;
>   case V4L2_MEMORY_DMABUF:
> - if (put_user(kp->m.fd, >m.fd))
> + if (put_user(kp->m.fd, >m.fd) ||
> + put_user(kp->length, >length))
>   return -EFAULT;
>   break;
>   }

-- 
Kind regards,

Sakari Ailus
e-mail: sakari.ai...@iki.fi XMPP: sai...@retiisi.org.uk
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] v4l: Fix dma buf single plane compat handling

2015-12-08 Thread grosikopulos 
Hi Sakari,
 
> Hi Laurent and Gjorgji,
> 
> On Mon, Dec 07, 2015 at 10:45:39AM +0200, Laurent Pinchart wrote:
>> From: Gjorgji Rosikopulos grosikopu...@mm-sol.com 
>> 
>> Buffer length is needed for single plane as well, otherwise
>> is uninitialized and behaviour is undetermined.
> 
> How about:
> 
> The v4l2_buffer length field must be passed as well from user to kernel and
> back, otherwise uninitialised values will be used.

Yes that's better :)

> 
>> 
>> Signed-off-by: Gjorgji Rosikopulos grosikopu...@mm-sol.com 
>> Signed-off-by: Laurent Pinchart laurent.pinch...@ideasonboard.com 
> 
> Acked-by: Sakari Ailus sakari.ai...@linux.intel.com 
> 
> Shouldn't this be submitted to stable as well?
> 
>> ---
>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 7 +--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>> 
>> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c 
>> b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>> index 8fd84a67478a..b0faa1f7e3a9 100644
>> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>> @@ -482,8 +482,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, 
>> struct v4l2_buffer32 __user
>>  return -EFAULT;
>>  break;
>>  case V4L2_MEMORY_DMABUF:
>> -if (get_user(kp->m.fd, >m.fd))
>> +if (get_user(kp->m.fd, >m.fd) ||
>> + get_user(kp->length, >length))
>>  return -EFAULT;
>> +
>>  break;
>>  }
>>  }
>> @@ -550,7 +552,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, 
>> struct v4l2_buffer32 __user
>>  return -EFAULT;
>>  break;
>>  case V4L2_MEMORY_DMABUF:
>> -if (put_user(kp->m.fd, >m.fd))
>> +if (put_user(kp->m.fd, >m.fd) ||
>> + put_user(kp->length, >length))
>>  return -EFAULT;
>>  break;
>>  }
> 
> -- 
> Kind regards,
> 
> Sakari Ailus
> e-mail: sakari.ai...@iki.fi XMPP: sai...@retiisi.org.uk 
> 

-- 



--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] v4l: Fix dma buf single plane compat handling

2015-12-08 Thread Laurent Pinchart 
Hi Sakari,

On Tuesday 08 December 2015 17:29:16 Sakari Ailus wrote:
> On Mon, Dec 07, 2015 at 10:45:39AM +0200, Laurent Pinchart wrote:
> > From: Gjorgji Rosikopulos 
> > 
> > Buffer length is needed for single plane as well, otherwise
> > is uninitialized and behaviour is undetermined.
> 
> How about:
> 
> The v4l2_buffer length field must be passed as well from user to kernel and
> back, otherwise uninitialised values will be used.
> 
> > Signed-off-by: Gjorgji Rosikopulos 
> > Signed-off-by: Laurent Pinchart 
> 
> Acked-by: Sakari Ailus 
> 
> Shouldn't this be submitted to stable as well?

I'll CC stable.

> > ---
> > 
> >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 7 +--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index
> > 8fd84a67478a..b0faa1f7e3a9 100644
> > --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > @@ -482,8 +482,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp,
> > struct v4l2_buffer32 __user> 
> > return -EFAULT;
> > 
> > break;
> > 
> > case V4L2_MEMORY_DMABUF:
> > -   if (get_user(kp->m.fd, >m.fd))
> > +   if (get_user(kp->m.fd, >m.fd) ||
> > +   get_user(kp->length, >length))
> > 
> > return -EFAULT;
> > 
> > +
> > 
> > break;
> > 
> > }
> > 
> > }
> > 
> > @@ -550,7 +552,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp,
> > struct v4l2_buffer32 __user> 
> > return -EFAULT;
> > 
> > break;
> > 
> > case V4L2_MEMORY_DMABUF:
> > -   if (put_user(kp->m.fd, >m.fd))
> > +   if (put_user(kp->m.fd, >m.fd) ||
> > +   put_user(kp->length, >length))
> > 
> > return -EFAULT;
> > 
> > break;
> > 
> > }

-- 
Regards,

Laurent Pinchart

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] v4l: Fix dma buf single plane compat handling

2015-12-07 Thread Laurent Pinchart 
From: Gjorgji Rosikopulos 

Buffer length is needed for single plane as well, otherwise
is uninitialized and behaviour is undetermined.

Signed-off-by: Gjorgji Rosikopulos 
Signed-off-by: Laurent Pinchart 
---
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 7 +--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c 
b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 8fd84a67478a..b0faa1f7e3a9 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -482,8 +482,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, 
struct v4l2_buffer32 __user
return -EFAULT;
break;
case V4L2_MEMORY_DMABUF:
-   if (get_user(kp->m.fd, >m.fd))
+   if (get_user(kp->m.fd, >m.fd) ||
+   get_user(kp->length, >length))
return -EFAULT;
+
break;
}
}
@@ -550,7 +552,8 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct 
v4l2_buffer32 __user
return -EFAULT;
break;
case V4L2_MEMORY_DMABUF:
-   if (put_user(kp->m.fd, >m.fd))
+   if (put_user(kp->m.fd, >m.fd) ||
+   put_user(kp->length, >length))
return -EFAULT;
break;
}
-- 
2.4.10

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html