All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hans Verkuil <hverkuil@xs4all.nl>
To: linux-media@vger.kernel.org
Cc: Daniel Mentz <danielmentz@google.com>,
	Hans Verkuil <hans.verkuil@cisco.com>
Subject: [PATCH 08/12] v4l2-compat-ioctl32.c: fix ctrl_is_pointer
Date: Fri, 26 Jan 2018 13:43:23 +0100	[thread overview]
Message-ID: <20180126124327.16653-9-hverkuil@xs4all.nl> (raw)
In-Reply-To: <20180126124327.16653-1-hverkuil@xs4all.nl>

From: Hans Verkuil <hans.verkuil@cisco.com>

ctrl_is_pointer just hardcoded two known string controls, but that
caused problems when using e.g. custom controls that use a pointer
for the payload.

Reimplement this function: it now finds the v4l2_ctrl (if the driver
uses the control framework) or it calls vidioc_query_ext_ctrl (if the
driver implements that directly).

In both cases it can now check if the control is a pointer control
or not.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
---
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 56 ++++++++++++++++++---------
 1 file changed, 37 insertions(+), 19 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index da8a56818a18..cf3d4bfcd132 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -18,6 +18,8 @@
 #include <linux/videodev2.h>
 #include <linux/v4l2-subdev.h>
 #include <media/v4l2-dev.h>
+#include <media/v4l2-fh.h>
+#include <media/v4l2-ctrls.h>
 #include <media/v4l2-ioctl.h>
 
 static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
@@ -601,24 +603,38 @@ struct v4l2_ext_control32 {
 	};
 } __attribute__ ((packed));
 
-/* The following function really belong in v4l2-common, but that causes
-   a circular dependency between modules. We need to think about this, but
-   for now this will do. */
-
-/* Return non-zero if this control is a pointer type. Currently only
-   type STRING is a pointer type. */
-static inline int ctrl_is_pointer(u32 id)
+/* Return true if this control is a pointer type. */
+static inline bool ctrl_is_pointer(struct file *file, u32 id)
 {
-	switch (id) {
-	case V4L2_CID_RDS_TX_PS_NAME:
-	case V4L2_CID_RDS_TX_RADIO_TEXT:
-		return 1;
-	default:
-		return 0;
+	struct video_device *vdev = video_devdata(file);
+	struct v4l2_fh *fh = NULL;
+	struct v4l2_ctrl_handler *hdl = NULL;
+	struct v4l2_query_ext_ctrl qec = { id };
+	const struct v4l2_ioctl_ops *ops = vdev->ioctl_ops;
+	int ret = -ENOTTY;
+
+	if (test_bit(V4L2_FL_USES_V4L2_FH, &vdev->flags))
+		fh = file->private_data;
+
+	if (fh && fh->ctrl_handler)
+		hdl = fh->ctrl_handler;
+	else if (vdev->ctrl_handler)
+		hdl = vdev->ctrl_handler;
+
+	if (hdl) {
+		struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, id);
+
+		return ctrl && ctrl->is_ptr;
 	}
+
+	if (ops->vidioc_query_ext_ctrl)
+		ret = ops->vidioc_query_ext_ctrl(file, fh, &qec);
+	return !ret && (qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD);
 }
 
-static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up)
+static int get_v4l2_ext_controls32(struct file *file,
+				   struct v4l2_ext_controls *kp,
+				   struct v4l2_ext_controls32 __user *up)
 {
 	struct v4l2_ext_control32 __user *ucontrols;
 	struct v4l2_ext_control __user *kcontrols;
@@ -651,7 +667,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
 			return -EFAULT;
 		if (get_user(id, &kcontrols->id))
 			return -EFAULT;
-		if (ctrl_is_pointer(id)) {
+		if (ctrl_is_pointer(file, id)) {
 			void __user *s;
 
 			if (get_user(p, &ucontrols->string))
@@ -666,7 +682,9 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
 	return 0;
 }
 
-static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up)
+static int put_v4l2_ext_controls32(struct file *file,
+				   struct v4l2_ext_controls *kp,
+				   struct v4l2_ext_controls32 __user *up)
 {
 	struct v4l2_ext_control32 __user *ucontrols;
 	struct v4l2_ext_control __user *kcontrols =
@@ -698,7 +716,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
 		/* Do not modify the pointer when copying a pointer control.
 		   The contents of the pointer was changed, not the pointer
 		   itself. */
-		if (ctrl_is_pointer(id))
+		if (ctrl_is_pointer(file, id))
 			size -= sizeof(ucontrols->value64);
 		if (copy_in_user(ucontrols, kcontrols, size))
 			return -EFAULT;
@@ -912,7 +930,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 	case VIDIOC_G_EXT_CTRLS:
 	case VIDIOC_S_EXT_CTRLS:
 	case VIDIOC_TRY_EXT_CTRLS:
-		err = get_v4l2_ext_controls32(&karg.v2ecs, up);
+		err = get_v4l2_ext_controls32(file, &karg.v2ecs, up);
 		compatible_arg = 0;
 		break;
 	case VIDIOC_DQEVENT:
@@ -939,7 +957,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 	case VIDIOC_G_EXT_CTRLS:
 	case VIDIOC_S_EXT_CTRLS:
 	case VIDIOC_TRY_EXT_CTRLS:
-		if (put_v4l2_ext_controls32(&karg.v2ecs, up))
+		if (put_v4l2_ext_controls32(file, &karg.v2ecs, up))
 			err = -EFAULT;
 		break;
 	case VIDIOC_S_EDID:
-- 
2.15.1

  parent reply	other threads:[~2018-01-26 12:43 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-26 12:43 [PATCH 00/12] v4l2-compat-ioctl32.c: remove set_fs(KERNEL_DS) Hans Verkuil
2018-01-26 12:43 ` [PATCH 01/12] vivid: fix module load error when enabling fb and no_error_inj=1 Hans Verkuil
2018-01-26 14:43   ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 02/12] v4l2-ioctl.c: use check_fmt for enum/g/s/try_fmt Hans Verkuil
2018-01-26 14:41   ` Sakari Ailus
2018-01-29 10:09     ` Hans Verkuil
2018-01-29 20:57       ` Sakari Ailus
2018-01-30  8:44     ` Hans Verkuil
2018-01-30 11:14       ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 03/12] v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF Hans Verkuil
2018-01-26 14:43   ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 04/12] v4l2-compat-ioctl32.c: fix the indentation Hans Verkuil
2018-01-26 14:57   ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 05/12] v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32 Hans Verkuil
2018-01-26 15:20   ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 06/12] v4l2-compat-ioctl32.c: avoid sizeof(type) Hans Verkuil
2018-01-26 15:35   ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 07/12] v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32 Hans Verkuil
2018-01-26 16:15   ` Sakari Ailus
2018-01-26 12:43 ` Hans Verkuil [this message]
2018-01-27 23:18   ` [PATCH 08/12] v4l2-compat-ioctl32.c: fix ctrl_is_pointer Sakari Ailus
2018-01-29 14:11     ` Mauro Carvalho Chehab
2018-01-26 12:43 ` [PATCH 09/12] v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32 Hans Verkuil
2018-01-29  9:47   ` Sakari Ailus
2018-01-29 14:13     ` Mauro Carvalho Chehab
2018-01-29 21:00       ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 10/12] v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type Hans Verkuil
2018-01-29  9:48   ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 11/12] v4l2-compat-ioctl32.c: don't copy back the result for certain errors Hans Verkuil
2018-01-29  9:56   ` Sakari Ailus
2018-01-29 10:02     ` Hans Verkuil
2018-01-29 21:01       ` Sakari Ailus
2018-01-26 12:43 ` [PATCH 12/12] v4l2-compat-ioctl32.c: refactor, fix security bug in compat ioctl32 Hans Verkuil
2018-01-29 15:14   ` Mauro Carvalho Chehab
2018-01-29 17:06   ` Sakari Ailus
2018-01-29 17:41     ` Hans Verkuil
2018-01-29 21:14       ` Sakari Ailus
2018-01-30  9:37     ` Hans Verkuil

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180126124327.16653-9-hverkuil@xs4all.nl \
    --to=hverkuil@xs4all.nl \
    --cc=danielmentz@google.com \
    --cc=hans.verkuil@cisco.com \
    --cc=linux-media@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.