releases/4.9.52/media-v4l2-compat-ioctl32-fix-timespec-conversion.patch

   1 From 9c7ba1d7634cef490b85bc64c4091ff004821bfd Mon Sep 17 00:00:00 2001
   2 From: Daniel Mentz <danielmentz@google.com>
   3 Date: Wed, 2 Aug 2017 23:42:17 -0400
   4 Subject: media: v4l2-compat-ioctl32: Fix timespec conversion
   5
   6 From: Daniel Mentz <danielmentz@google.com>
   7
   8 commit 9c7ba1d7634cef490b85bc64c4091ff004821bfd upstream.
   9
  10 Certain syscalls like recvmmsg support 64 bit timespec values for the
  11 X32 ABI. The helper function compat_put_timespec converts a timespec
  12 value to a 32 bit or 64 bit value depending on what ABI is used. The
  13 v4l2 compat layer, however, is not designed to support 64 bit timespec
  14 values and always uses 32 bit values. Hence, compat_put_timespec must
  15 not be used.
  16
  17 Without this patch, user space will be provided with bad timestamp
  18 values from the VIDIOC_DQEVENT ioctl. Also, fields of the struct
  19 v4l2_event32 that come immediately after timestamp get overwritten,
  20 namely the field named id.
  21
  22 Fixes: 81993e81a994 ("compat: Get rid of (get|put)_compat_time(val|spec)")
  23 Cc: H. Peter Anvin <hpa@linux.intel.com>
  24 Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
  25 Cc: Tiffany Lin <tiffany.lin@mediatek.com>
  26 Cc: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
  27 Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
  28 Signed-off-by: Daniel Mentz <danielmentz@google.com>
  29 Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
  30 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
  31 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32
  33 ---
  34  drivers/media/v4l2-core/v4l2-compat-ioctl32.c |    3 ++-
  35  1 file changed, 2 insertions(+), 1 deletion(-)
  36
  37 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
  38 +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
  39 @@ -773,7 +773,8 @@ static int put_v4l2_event32(struct v4l2_
  40                 copy_to_user(&up->u, &kp->u, sizeof(kp->u)) ||
  41                 put_user(kp->pending, &up->pending) ||
  42                 put_user(kp->sequence, &up->sequence) ||
  43 -               compat_put_timespec(&kp->timestamp, &up->timestamp) ||
  44 +               put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) ||
  45 +               put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) ||
  46                 put_user(kp->id, &up->id) ||
  47                 copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32)))
  48                         return -EFAULT;