From: Greg Kroah-Hartman Date: Sun, 10 Apr 2016 00:40:44 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v4.5.1~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b625cc6fac1af973eaba450e481d91c0b379ba57;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: 8250-use-callbacks-to-access-uart_dll-uart_dlm.patch adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch net-irda-fix-use-after-free-in-irtty_open.patch saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch --- diff --git a/queue-3.14/8250-use-callbacks-to-access-uart_dll-uart_dlm.patch b/queue-3.14/8250-use-callbacks-to-access-uart_dll-uart_dlm.patch new file mode 100644 index 00000000000..042f0e49e64 --- /dev/null +++ b/queue-3.14/8250-use-callbacks-to-access-uart_dll-uart_dlm.patch @@ -0,0 +1,54 @@ +From 0b41ce991052022c030fd868e03877700220b090 Mon Sep 17 00:00:00 2001 +From: Sebastian Frias +Date: Fri, 18 Dec 2015 17:40:05 +0100 +Subject: 8250: use callbacks to access UART_DLL/UART_DLM + +From: Sebastian Frias + +commit 0b41ce991052022c030fd868e03877700220b090 upstream. + +Some UART HW has a single register combining UART_DLL/UART_DLM +(this was probably forgotten in the change that introduced the +callbacks, commit b32b19b8ffc05cbd3bf91c65e205f6a912ca15d9) + +Fixes: b32b19b8ffc0 ("[SERIAL] 8250: set divisor register correctly ...") + +Signed-off-by: Sebastian Frias +Reviewed-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_core.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -686,22 +686,16 @@ static int size_fifo(struct uart_8250_po + */ + static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p) + { +- unsigned char old_dll, old_dlm, old_lcr; +- unsigned int id; ++ unsigned char old_lcr; ++ unsigned int id, old_dl; + + old_lcr = serial_in(p, UART_LCR); + serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A); ++ old_dl = serial_dl_read(p); ++ serial_dl_write(p, 0); ++ id = serial_dl_read(p); ++ serial_dl_write(p, old_dl); + +- old_dll = serial_in(p, UART_DLL); +- old_dlm = serial_in(p, UART_DLM); +- +- serial_out(p, UART_DLL, 0); +- serial_out(p, UART_DLM, 0); +- +- id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8; +- +- serial_out(p, UART_DLL, old_dll); +- serial_out(p, UART_DLM, old_dlm); + serial_out(p, UART_LCR, old_lcr); + + return id; diff --git a/queue-3.14/adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch b/queue-3.14/adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch new file mode 100644 index 00000000000..13e19fdceb1 --- /dev/null +++ b/queue-3.14/adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch @@ -0,0 +1,93 @@ +From b339a72e04a62f0b1882c43492fc712f1176b3e6 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 10 Feb 2016 09:32:25 -0200 +Subject: [media] adv7511: TX_EDID_PRESENT is still 1 after a disconnect + +From: Hans Verkuil + +commit b339a72e04a62f0b1882c43492fc712f1176b3e6 upstream. + +The V4L2_CID_TX_EDID_PRESENT control reports if an EDID is present. +The adv7511 however still reported the EDID present after disconnecting +the HDMI cable. Fix the logic regarding this control. And when the EDID +is disconnected also call ADV7511_EDID_DETECT to notify the bridge driver. +This was also missing. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/adv7511.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/media/i2c/adv7511.c ++++ b/drivers/media/i2c/adv7511.c +@@ -827,12 +827,23 @@ static void adv7511_dbg_dump_edid(int lv + } + } + ++static void adv7511_notify_no_edid(struct v4l2_subdev *sd) ++{ ++ struct adv7511_state *state = get_adv7511_state(sd); ++ struct adv7511_edid_detect ed; ++ ++ /* We failed to read the EDID, so send an event for this. */ ++ ed.present = false; ++ ed.segment = adv7511_rd(sd, 0xc4); ++ v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); ++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x0); ++} ++ + static void adv7511_edid_handler(struct work_struct *work) + { + struct delayed_work *dwork = to_delayed_work(work); + struct adv7511_state *state = container_of(dwork, struct adv7511_state, edid_handler); + struct v4l2_subdev *sd = &state->sd; +- struct adv7511_edid_detect ed; + + v4l2_dbg(1, debug, sd, "%s:\n", __func__); + +@@ -857,9 +868,7 @@ static void adv7511_edid_handler(struct + } + + /* We failed to read the EDID, so send an event for this. */ +- ed.present = false; +- ed.segment = adv7511_rd(sd, 0xc4); +- v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); ++ adv7511_notify_no_edid(sd); + v4l2_dbg(1, debug, sd, "%s: no edid found\n", __func__); + } + +@@ -930,7 +939,6 @@ static void adv7511_check_monitor_presen + /* update read only ctrls */ + v4l2_ctrl_s_ctrl(state->hotplug_ctrl, adv7511_have_hotplug(sd) ? 0x1 : 0x0); + v4l2_ctrl_s_ctrl(state->rx_sense_ctrl, adv7511_have_rx_sense(sd) ? 0x1 : 0x0); +- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0); + + if ((status & MASK_ADV7511_HPD_DETECT) && ((status & MASK_ADV7511_MSEN_DETECT) || state->edid.segments)) { + v4l2_dbg(1, debug, sd, "%s: hotplug and (rx-sense or edid)\n", __func__); +@@ -960,6 +968,7 @@ static void adv7511_check_monitor_presen + } + adv7511_s_power(sd, false); + memset(&state->edid, 0, sizeof(struct adv7511_state_edid)); ++ adv7511_notify_no_edid(sd); + } + } + +@@ -1036,6 +1045,7 @@ static bool adv7511_check_edid_status(st + } + /* one more segment read ok */ + state->edid.segments = segment + 1; ++ v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, 0x1); + if (((state->edid.data[0x7e] >> 1) + 1) > state->edid.segments) { + /* Request next EDID segment */ + v4l2_dbg(1, debug, sd, "%s: request segment %d\n", __func__, state->edid.segments); +@@ -1055,7 +1065,6 @@ static bool adv7511_check_edid_status(st + ed.present = true; + ed.segment = 0; + state->edid_detect_counter++; +- v4l2_ctrl_s_ctrl(state->have_edid0_ctrl, state->edid.segments ? 0x1 : 0x0); + v4l2_subdev_notify(sd, ADV7511_EDID_DETECT, (void *)&ed); + return ed.present; + } diff --git a/queue-3.14/bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch b/queue-3.14/bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch new file mode 100644 index 00000000000..793578d228a --- /dev/null +++ b/queue-3.14/bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch @@ -0,0 +1,102 @@ +From 5c915c68763889f0183a1cc61c84bb228b60124a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 7 Feb 2016 09:24:29 -0200 +Subject: [media] bttv: Width must be a multiple of 16 when capturing planar formats + +From: Hans de Goede + +commit 5c915c68763889f0183a1cc61c84bb228b60124a upstream. + +On my bttv card "Hauppauge WinTV [card=10]" capturing in YV12 fmt at max +size results in a solid green rectangle being captured (all colors 0 in +YUV). + +This turns out to be caused by max-width (924) not being a multiple of 16. + +We've likely never hit this problem before since normally xawtv / tvtime, +etc. will prefer packed pixel formats. But when using a video card which +is using xf86-video-modesetting + glamor, only planar XVideo fmts are +available, and xawtv will chose a matching capture format to avoid needing +to do conversion, triggering the solid green window problem. + +Signed-off-by: Hans de Goede +Acked-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/bt8xx/bttv-driver.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -2333,6 +2333,19 @@ static int bttv_g_fmt_vid_overlay(struct + return 0; + } + ++static void bttv_get_width_mask_vid_cap(const struct bttv_format *fmt, ++ unsigned int *width_mask, ++ unsigned int *width_bias) ++{ ++ if (fmt->flags & FORMAT_FLAGS_PLANAR) { ++ *width_mask = ~15; /* width must be a multiple of 16 pixels */ ++ *width_bias = 8; /* nearest */ ++ } else { ++ *width_mask = ~3; /* width must be a multiple of 4 pixels */ ++ *width_bias = 2; /* nearest */ ++ } ++} ++ + static int bttv_try_fmt_vid_cap(struct file *file, void *priv, + struct v4l2_format *f) + { +@@ -2342,6 +2355,7 @@ static int bttv_try_fmt_vid_cap(struct f + enum v4l2_field field; + __s32 width, height; + __s32 height2; ++ unsigned int width_mask, width_bias; + int rc; + + fmt = format_by_fourcc(f->fmt.pix.pixelformat); +@@ -2374,9 +2388,9 @@ static int bttv_try_fmt_vid_cap(struct f + width = f->fmt.pix.width; + height = f->fmt.pix.height; + ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + rc = limit_scaled_size_lock(fh, &width, &height, field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 0); + if (0 != rc) +@@ -2409,6 +2423,7 @@ static int bttv_s_fmt_vid_cap(struct fil + struct bttv_fh *fh = priv; + struct bttv *btv = fh->btv; + __s32 width, height; ++ unsigned int width_mask, width_bias; + enum v4l2_field field; + + retval = bttv_switch_type(fh, f->type); +@@ -2423,9 +2438,10 @@ static int bttv_s_fmt_vid_cap(struct fil + height = f->fmt.pix.height; + field = f->fmt.pix.field; + ++ fmt = format_by_fourcc(f->fmt.pix.pixelformat); ++ bttv_get_width_mask_vid_cap(fmt, &width_mask, &width_bias); + retval = limit_scaled_size_lock(fh, &width, &height, f->fmt.pix.field, +- /* width_mask: 4 pixels */ ~3, +- /* width_bias: nearest */ 2, ++ width_mask, width_bias, + /* adjust_size */ 1, + /* adjust_crop */ 1); + if (0 != retval) +@@ -2433,8 +2449,6 @@ static int bttv_s_fmt_vid_cap(struct fil + + f->fmt.pix.field = field; + +- fmt = format_by_fourcc(f->fmt.pix.pixelformat); +- + /* update our state informations */ + fh->fmt = fmt; + fh->cap.field = f->fmt.pix.field; diff --git a/queue-3.14/media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch b/queue-3.14/media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch new file mode 100644 index 00000000000..8fb0de41704 --- /dev/null +++ b/queue-3.14/media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch @@ -0,0 +1,90 @@ +From 7df5ab8774aa383c6d2bff00688d004585d96dfd Mon Sep 17 00:00:00 2001 +From: Tiffany Lin +Date: Tue, 19 Jan 2016 05:56:50 -0200 +Subject: [media] media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32 + +From: Tiffany Lin + +commit 7df5ab8774aa383c6d2bff00688d004585d96dfd upstream. + +In v4l2-compliance utility, test QUERYBUF required correct length +value to go through each planar to check planar's length in +multi-planar buffer type + +Signed-off-by: Tiffany Lin +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 21 ++++++++------------- + 1 file changed, 8 insertions(+), 13 deletions(-) + +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -392,7 +392,8 @@ static int get_v4l2_buffer32(struct v4l2 + get_user(kp->index, &up->index) || + get_user(kp->type, &up->type) || + get_user(kp->flags, &up->flags) || +- get_user(kp->memory, &up->memory)) ++ get_user(kp->memory, &up->memory) || ++ get_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_OUTPUT(kp->type)) +@@ -404,9 +405,6 @@ static int get_v4l2_buffer32(struct v4l2 + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +- if (get_user(kp->length, &up->length)) +- return -EFAULT; +- + num_planes = kp->length; + if (num_planes == 0) { + kp->m.planes = NULL; +@@ -439,16 +437,14 @@ static int get_v4l2_buffer32(struct v4l2 + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (get_user(kp->length, &up->length) || +- get_user(kp->m.offset, &up->m.offset)) ++ if (get_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: + { + compat_long_t tmp; + +- if (get_user(kp->length, &up->length) || +- get_user(tmp, &up->m.userptr)) ++ if (get_user(tmp, &up->m.userptr)) + return -EFAULT; + + kp->m.userptr = (unsigned long)compat_ptr(tmp); +@@ -490,7 +486,8 @@ static int put_v4l2_buffer32(struct v4l2 + copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || + put_user(kp->sequence, &up->sequence) || + put_user(kp->reserved2, &up->reserved2) || +- put_user(kp->reserved, &up->reserved)) ++ put_user(kp->reserved, &up->reserved) || ++ put_user(kp->length, &up->length)) + return -EFAULT; + + if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { +@@ -513,13 +510,11 @@ static int put_v4l2_buffer32(struct v4l2 + } else { + switch (kp->memory) { + case V4L2_MEMORY_MMAP: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.offset, &up->m.offset)) ++ if (put_user(kp->m.offset, &up->m.offset)) + return -EFAULT; + break; + case V4L2_MEMORY_USERPTR: +- if (put_user(kp->length, &up->length) || +- put_user(kp->m.userptr, &up->m.userptr)) ++ if (put_user(kp->m.userptr, &up->m.userptr)) + return -EFAULT; + break; + case V4L2_MEMORY_OVERLAY: diff --git a/queue-3.14/net-irda-fix-use-after-free-in-irtty_open.patch b/queue-3.14/net-irda-fix-use-after-free-in-irtty_open.patch new file mode 100644 index 00000000000..d45c24be50e --- /dev/null +++ b/queue-3.14/net-irda-fix-use-after-free-in-irtty_open.patch @@ -0,0 +1,65 @@ +From 401879c57f01cbf2da204ad2e8db910525c6dbea Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Sat, 9 Jan 2016 17:48:45 -0800 +Subject: net: irda: Fix use-after-free in irtty_open() + +From: Peter Hurley + +commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream. + +The N_IRDA line discipline may access the previous line discipline's closed +and already-fre private data on open [1]. + +The tty->disc_data field _never_ refers to valid data on entry to the +line discipline's open() method. Rather, the ldisc is expected to +initialize that field for its own use for the lifetime of the instance +(ie. from open() to close() only). + +[1] + ================================================================== + BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068 + Read of size 4 by task a.out/13960 + ============================================================================= + BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected + ----------------------------------------------------------------------------- + ... + Call Trace: + [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279 + [] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436 + [] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447 + [] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567 + [< inline >] tiocsetd drivers/tty/tty_io.c:2650 + [] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883 + [< inline >] vfs_ioctl fs/ioctl.c:43 + [] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607 + [< inline >] SYSC_ioctl fs/ioctl.c:622 + [] SyS_ioctl+0x74/0x80 fs/ioctl.c:613 + [] entry_SYSCALL_64_fastpath+0x16/0x7a + +Reported-and-tested-by: Dmitry Vyukov +Signed-off-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/irda/irtty-sir.c | 10 ---------- + 1 file changed, 10 deletions(-) + +--- a/drivers/net/irda/irtty-sir.c ++++ b/drivers/net/irda/irtty-sir.c +@@ -430,16 +430,6 @@ static int irtty_open(struct tty_struct + + /* Module stuff handled via irda_ldisc.owner - Jean II */ + +- /* First make sure we're not already connected. */ +- if (tty->disc_data != NULL) { +- priv = tty->disc_data; +- if (priv && priv->magic == IRTTY_MAGIC) { +- ret = -EEXIST; +- goto out; +- } +- tty->disc_data = NULL; /* ### */ +- } +- + /* stop the underlying driver */ + irtty_stop_receiver(tty, TRUE); + if (tty->ops->stop) diff --git a/queue-3.14/saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch b/queue-3.14/saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch new file mode 100644 index 00000000000..beafe4a83a4 --- /dev/null +++ b/queue-3.14/saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch @@ -0,0 +1,62 @@ +From 3e71da19f9dc22e39a755d6ae9678661abb66adc Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 14 Feb 2016 17:51:37 -0200 +Subject: [media] saa7134: Fix bytesperline not being set correctly for planar formats + +From: Hans de Goede + +commit 3e71da19f9dc22e39a755d6ae9678661abb66adc upstream. + +bytesperline should be the bytesperline for the first plane for planar +formats, not that of all planes combined. + +This fixes a crash in xawtv caused by the wrong bpl. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1305389 +Reported-and-tested-by: Stas Sergeev + +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/pci/saa7134/saa7134-video.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -1342,10 +1342,13 @@ static int saa7134_g_fmt_vid_cap(struct + f->fmt.pix.height = dev->height; + f->fmt.pix.field = dev->cap.field; + f->fmt.pix.pixelformat = dev->fmt->fourcc; +- f->fmt.pix.bytesperline = +- (f->fmt.pix.width * dev->fmt->depth) >> 3; ++ if (dev->fmt->planar) ++ f->fmt.pix.bytesperline = f->fmt.pix.width; ++ else ++ f->fmt.pix.bytesperline = ++ (f->fmt.pix.width * dev->fmt->depth) / 8; + f->fmt.pix.sizeimage = +- f->fmt.pix.height * f->fmt.pix.bytesperline; ++ (f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8; + f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M; + f->fmt.pix.priv = 0; + return 0; +@@ -1424,10 +1427,13 @@ static int saa7134_try_fmt_vid_cap(struc + if (f->fmt.pix.height > maxh) + f->fmt.pix.height = maxh; + f->fmt.pix.width &= ~0x03; +- f->fmt.pix.bytesperline = +- (f->fmt.pix.width * fmt->depth) >> 3; ++ if (fmt->planar) ++ f->fmt.pix.bytesperline = f->fmt.pix.width; ++ else ++ f->fmt.pix.bytesperline = ++ (f->fmt.pix.width * fmt->depth) / 8; + f->fmt.pix.sizeimage = +- f->fmt.pix.height * f->fmt.pix.bytesperline; ++ (f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8; + f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M; + f->fmt.pix.priv = 0; + diff --git a/queue-3.14/series b/queue-3.14/series index fa2330dc2dd..142b344c39c 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -36,3 +36,9 @@ crypto-ccp-limit-the-amount-of-information-exported.patch crypto-ccp-don-t-assume-export-import-areas-are-aligned.patch crypto-ccp-memset-request-context-to-zero-during-import.patch hid-logitech-fix-dual-action-gamepad-support.patch +net-irda-fix-use-after-free-in-irtty_open.patch +8250-use-callbacks-to-access-uart_dll-uart_dlm.patch +saa7134-fix-bytesperline-not-being-set-correctly-for-planar-formats.patch +adv7511-tx_edid_present-is-still-1-after-a-disconnect.patch +bttv-width-must-be-a-multiple-of-16-when-capturing-planar-formats.patch +media-v4l2-compat-ioctl32-fix-missing-length-copy-in-put_v4l2_buffer32.patch