releases/3.18.103/media-v4l2-compat-ioctl32-initialize-a-reserved-field.patch

   1 From foo@baz Wed Apr  4 17:30:18 CEST 2018
   2 From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
   3 Date: Wed, 28 Mar 2018 15:12:37 -0300
   4 Subject: media: v4l2-compat-ioctl32: initialize a reserved field
   5 To: Linux Media Mailing List <linux-media@vger.kernel.org>, stable@vger.kernel.org
   6 Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com>, Mauro Carvalho Chehab <mchehab@infradead.org>, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
   7 Message-ID: <d8a647b26822fb0a86f6ee7dff4d6eb1e85e1398.1522260310.git.mchehab@s-opensource.com>
   8
   9 From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
  10
  11 The get_v4l2_create32() function is missing a logic with
  12 would be cleaning a reserved field, causing v4l2-compliance
  13 to complain:
  14
  15  Buffer ioctls (Input 0):
  16                 fail: v4l2-test-buffers.cpp(506): check_0(crbufs.reserved, sizeof(crbufs.reserved))
  17         test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: FAIL
  18
  19 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  drivers/media/v4l2-core/v4l2-compat-ioctl32.c |    3 ++-
  23  1 file changed, 2 insertions(+), 1 deletion(-)
  24
  25 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
  26 +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
  27 @@ -247,7 +247,8 @@ static int get_v4l2_create32(struct v4l2
  28  {
  29         if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
  30             copy_in_user(kp, up,
  31 -                        offsetof(struct v4l2_create_buffers32, format)))
  32 +                        offsetof(struct v4l2_create_buffers32, format)) ||
  33 +           copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
  34                 return -EFAULT;
  35         return __get_v4l2_format32(&kp->format, &up->format,
  36                                    aux_buf, aux_space);