diff options
| author | Hans Verkuil <hverkuil@xs4all.nl> | 2009-03-08 14:35:23 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-03-30 17:43:16 +0200 |
| commit | 9f1a693f76700018d921cd7af86f7c994a300613 (patch) | |
| tree | 73051e624f100b00835ed99d1895645d1d1c4987 /drivers/media/video/v4l2-ioctl.c | |
| parent | V4L/DVB (10919): tlv320aic23b: use v4l2-i2c-drv.h instead of drv-legacy.h (diff) | |
| download | linux-9f1a693f76700018d921cd7af86f7c994a300613.tar.xz linux-9f1a693f76700018d921cd7af86f7c994a300613.zip | |
V4L/DVB (10920): v4l2-ioctl: fix partial-copy code.
The code to optimize the usercopy only checked the ioctl NR field. However,
this code is also called for non-V4L2 ioctls (either private or ioctls from
linux/dvb/audio.h and linux/dvb/video.h for decoder drivers like ivtv).
If such an ioctl has the same NR as a V4L2 ioctl, then disaster strikes.
Modified the code to check on the full command ID.
Thanks to Martin Dauskardt for tracing the ivtv breakage to this particular
change.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video/v4l2-ioctl.c')
| -rw-r--r-- | drivers/media/video/v4l2-ioctl.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c index df8d1ff1a577..54ba6b0b951f 100644 --- a/drivers/media/video/v4l2-ioctl.c +++ b/drivers/media/video/v4l2-ioctl.c @@ -1796,11 +1796,12 @@ static long __video_do_ioctl(struct file *file, static unsigned long cmd_input_size(unsigned int cmd) { /* Size of structure up to and including 'field' */ -#define CMDINSIZE(cmd, type, field) case _IOC_NR(VIDIOC_##cmd): return \ - offsetof(struct v4l2_##type, field) + \ - sizeof(((struct v4l2_##type *)0)->field); +#define CMDINSIZE(cmd, type, field) \ + case VIDIOC_##cmd: \ + return offsetof(struct v4l2_##type, field) + \ + sizeof(((struct v4l2_##type *)0)->field); - switch (_IOC_NR(cmd)) { + switch (cmd) { CMDINSIZE(ENUM_FMT, fmtdesc, type); CMDINSIZE(G_FMT, format, type); CMDINSIZE(QUERYBUF, buffer, type); |