| From: Daniel Mentz <danielmentz@google.com> |
| Date: Wed, 2 Aug 2017 23:42:17 -0400 |
| Subject: media: v4l2-compat-ioctl32: Fix timespec conversion |
| |
| commit 9c7ba1d7634cef490b85bc64c4091ff004821bfd upstream. |
| |
| Certain syscalls like recvmmsg support 64 bit timespec values for the |
| X32 ABI. The helper function compat_put_timespec converts a timespec |
| value to a 32 bit or 64 bit value depending on what ABI is used. The |
| v4l2 compat layer, however, is not designed to support 64 bit timespec |
| values and always uses 32 bit values. Hence, compat_put_timespec must |
| not be used. |
| |
| Without this patch, user space will be provided with bad timestamp |
| values from the VIDIOC_DQEVENT ioctl. Also, fields of the struct |
| v4l2_event32 that come immediately after timestamp get overwritten, |
| namely the field named id. |
| |
| Fixes: 81993e81a994 ("compat: Get rid of (get|put)_compat_time(val|spec)") |
| |
| Cc: H. Peter Anvin <hpa@linux.intel.com> |
| Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> |
| Cc: Tiffany Lin <tiffany.lin@mediatek.com> |
| Cc: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> |
| Cc: Sakari Ailus <sakari.ailus@linux.intel.com> |
| Signed-off-by: Daniel Mentz <danielmentz@google.com> |
| Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c |
| +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c |
| @@ -731,7 +731,8 @@ static int put_v4l2_event32(struct v4l2_ |
| copy_to_user(&up->u, &kp->u, sizeof(kp->u)) || |
| put_user(kp->pending, &up->pending) || |
| put_user(kp->sequence, &up->sequence) || |
| - compat_put_timespec(&kp->timestamp, &up->timestamp) || |
| + put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || |
| + put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) || |
| put_user(kp->id, &up->id) || |
| copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32))) |
| return -EFAULT; |