[PATCH 0/5] Remaining COMPILE_TEST and smatch cleanups

[PATCH 0/5] Remaining COMPILE_TEST and smatch cleanups

[Mauro Carvalho Chehab]

There were several interactions at the COMPILE_TEST and smatch
patch series. While I applied most of them, there are 5 patches that
I kept out of it. The omap3 patch that were in my tree was the old
one. So, I'm re-posting it.

The ioctl32 patches are the latest version. Let's repost it to get some
acks, as this patch touches at V4L2 core, so a careful review is
always a good idea.

Arnd Bergmann (1):
  media: omap3isp: allow it to build with COMPILE_TEST

Laurent Pinchart (1):
  media: omap3isp: Enable driver compilation on ARM with COMPILE_TEST

Mauro Carvalho Chehab (3):
  omap: omap-iommu.h: allow building drivers with COMPILE_TEST
  media: v4l2-compat-ioctl32: fix several __user annotations
  media: v4l2-compat-ioctl32: better name userspace pointers

 drivers/media/platform/Kconfig                |   7 +-
 drivers/media/platform/omap3isp/isp.c         |   8 +
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 623 +++++++++++++-------------
 include/linux/omap-iommu.h                    |   5 +
 4 files changed, 338 insertions(+), 305 deletions(-)

-- 
2.14.3

[PATCH 1/5] omap: omap-iommu.h: allow building drivers with COMPILE_TEST

[Mauro Carvalho Chehab]

Drivers that depend on omap-iommu.h (currently, just omap3isp)
need a stub implementation in order to be built with COMPILE_TEST.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---
 include/linux/omap-iommu.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/linux/omap-iommu.h b/include/linux/omap-iommu.h
index c1aede46718b..ce1b7c6283ee 100644
--- a/include/linux/omap-iommu.h
+++ b/include/linux/omap-iommu.h
@@ -13,7 +13,12 @@
 #ifndef _OMAP_IOMMU_H_
 #define _OMAP_IOMMU_H_
 
+#ifdef CONFIG_OMAP_IOMMU
 extern void omap_iommu_save_ctx(struct device *dev);
 extern void omap_iommu_restore_ctx(struct device *dev);
+#else
+static inline void omap_iommu_save_ctx(struct device *dev) {}
+static inline void omap_iommu_restore_ctx(struct device *dev) {}
+#endif
 
 #endif
-- 
2.14.3

[PATCH 2/5] media: omap3isp: Enable driver compilation on ARM with COMPILE_TEST

[Mauro Carvalho Chehab]

From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

The omap3isp driver can't be compiled on non-ARM platforms but has no
compile-time dependency on OMAP. It however requires common clock
framework support, which isn't provided by all ARM platforms.

Drop the OMAP dependency when COMPILE_TEST is set and add ARM and
COMMON_CLK dependencies.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---
 drivers/media/platform/Kconfig | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 91b0c7324afb..1ee915b794c0 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -62,7 +62,10 @@ config VIDEO_MUX
 
 config VIDEO_OMAP3
 	tristate "OMAP 3 Camera support"
-	depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API && ARCH_OMAP3
+	depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
+	depends on ARCH_OMAP3 || COMPILE_TEST
+	depends on ARM
+	depends on COMMON_CLK
 	depends on HAS_DMA && OF
 	depends on OMAP_IOMMU
 	select ARM_DMA_USE_IOMMU
-- 
2.14.3

[PATCH 3/5] media: omap3isp: allow it to build with COMPILE_TEST

[Mauro Carvalho Chehab]

From: Arnd Bergmann <arnd@arndb.de>

There aren't much things required for it to build with COMPILE_TEST.
It just needs to not compile the code that depends on arm-specific
iommu implementation.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Co-developed-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---
 drivers/media/platform/Kconfig        | 6 ++----
 drivers/media/platform/omap3isp/isp.c | 8 ++++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index 1ee915b794c0..2757b621091c 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -63,12 +63,10 @@ config VIDEO_MUX
 config VIDEO_OMAP3
 	tristate "OMAP 3 Camera support"
 	depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
-	depends on ARCH_OMAP3 || COMPILE_TEST
-	depends on ARM
+	depends on ((ARCH_OMAP3 && OMAP_IOMMU) || COMPILE_TEST)
 	depends on COMMON_CLK
 	depends on HAS_DMA && OF
-	depends on OMAP_IOMMU
-	select ARM_DMA_USE_IOMMU
+	select ARM_DMA_USE_IOMMU if OMAP_IOMMU
 	select VIDEOBUF2_DMA_CONTIG
 	select MFD_SYSCON
 	select V4L2_FWNODE
diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 16c50099cccd..b8c8761a76b6 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -61,7 +61,9 @@
 #include <linux/sched.h>
 #include <linux/vmalloc.h>
 
+#ifdef CONFIG_ARM_DMA_USE_IOMMU
 #include <asm/dma-iommu.h>
+#endif
 
 #include <media/v4l2-common.h>
 #include <media/v4l2-fwnode.h>
@@ -1938,12 +1940,15 @@ static int isp_initialize_modules(struct isp_device *isp)
 
 static void isp_detach_iommu(struct isp_device *isp)
 {
+#ifdef CONFIG_ARM_DMA_USE_IOMMU
 	arm_iommu_release_mapping(isp->mapping);
 	isp->mapping = NULL;
+#endif
 }
 
 static int isp_attach_iommu(struct isp_device *isp)
 {
+#ifdef CONFIG_ARM_DMA_USE_IOMMU
 	struct dma_iommu_mapping *mapping;
 	int ret;
 
@@ -1972,6 +1977,9 @@ static int isp_attach_iommu(struct isp_device *isp)
 error:
 	isp_detach_iommu(isp);
 	return ret;
+#else
+	return -ENODEV;
+#endif
 }
 
 /*
-- 
2.14.3

[PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Smatch report several issues with bad __user annotations:

  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
  drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid

Fix them.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
 1 file changed, 35 insertions(+), 16 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index d03a44d89649..c951ac3faf46 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
 			return -EFAULT;
 		break;
 	case V4L2_MEMORY_USERPTR:
-		if (get_user(p, &up->m.userptr) ||
-		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
+		if (get_user(p, &up->m.userptr)||
+		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
 			     &up32->m.userptr))
 			return -EFAULT;
 		break;
@@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
 	u32 length;
 	enum v4l2_memory memory;
 	struct v4l2_plane32 __user *uplane32;
-	struct v4l2_plane __user *uplane;
+	struct v4l2_plane *uplane;
 	compat_caddr_t p;
 	int ret;
 
@@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
 
 		if (num_planes == 0)
 			return 0;
-
-		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
+		/* We need to define uplane without __user, even though
+		 * it does point to data in userspace here. The reason is
+		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
+		 * so its definition in videodev2.h doesn't have a
+		 * __user markup. Defining uplane with __user causes
+		 * smatch warnings, so instead declare it without __user
+		 * and cast it as a userspace pointer to put_v4l2_plane32().
+		 */
+		if (get_user(uplane, &kp->m.planes))
 			return -EFAULT;
 		if (get_user(p, &up->m.planes))
 			return -EFAULT;
 		uplane32 = compat_ptr(p);
 
 		while (num_planes--) {
-			ret = put_v4l2_plane32(uplane, uplane32, memory);
+			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
 			if (ret)
 				return ret;
 			++uplane;
@@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
 
 	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
 	    get_user(tmp, &up->base) ||
-	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
+	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
 	    assign_in_user(&kp->capability, &up->capability) ||
 	    assign_in_user(&kp->flags, &up->flags) ||
 	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
@@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
 
 	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
 	    get_user(base, &kp->base) ||
-	    put_user(ptr_to_compat(base), &up->base) ||
+	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
 	    assign_in_user(&up->capability, &kp->capability) ||
 	    assign_in_user(&up->flags, &kp->flags) ||
 	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
@@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
 				   struct v4l2_ext_controls32 __user *up)
 {
 	struct v4l2_ext_control32 __user *ucontrols;
-	struct v4l2_ext_control __user *kcontrols;
+	struct v4l2_ext_control *kcontrols;
 	u32 count;
 	u32 n;
 	compat_caddr_t p;
 
+	/*
+	 * We need to define kcontrols without __user, even though it does
+	 * point to data in userspace here. The reason is that v4l2-ioctl.c
+	 * copies it from userspace to kernelspace, so its definition in
+	 * videodev2.h doesn't have a __user markup. Defining kcontrols
+	 * with __user causes smatch warnings, so instead declare it
+	 * without __user and cast it as a userspace pointer where needed.
+	 */
 	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
 	    assign_in_user(&up->which, &kp->which) ||
 	    get_user(count, &kp->count) ||
@@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
 		unsigned int size = sizeof(*ucontrols);
 		u32 id;
 
-		if (get_user(id, &kcontrols->id) ||
+		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||
 		    put_user(id, &ucontrols->id) ||
-		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
-		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
+		    assign_in_user(&ucontrols->size,
+				   (unsigned int __user *)&kcontrols->size) ||
+		    copy_in_user(&ucontrols->reserved2,
+				 (unsigned int __user *)&kcontrols->reserved2,
 				 sizeof(ucontrols->reserved2)))
 			return -EFAULT;
 
@@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
 		if (ctrl_is_pointer(file, id))
 			size -= sizeof(ucontrols->value64);
 
-		if (copy_in_user(ucontrols, kcontrols, size))
+		if (copy_in_user(ucontrols,
+			         (unsigned int __user *)kcontrols, size))
 			return -EFAULT;
 
 		ucontrols++;
@@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
 	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
 	    assign_in_user(&kp->pad, &up->pad) ||
 	    assign_in_user(&kp->start_block, &up->start_block) ||
-	    assign_in_user(&kp->blocks, &up->blocks) ||
+	    assign_in_user(&kp->blocks,
+			   (unsigned char __user *)&up->blocks) ||
 	    get_user(tmp, &up->edid) ||
-	    put_user(compat_ptr(tmp), &kp->edid) ||
+	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
 	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
 		return -EFAULT;
 	return 0;
@@ -970,7 +989,7 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
 	    assign_in_user(&up->start_block, &kp->start_block) ||
 	    assign_in_user(&up->blocks, &kp->blocks) ||
 	    get_user(edid, &kp->edid) ||
-	    put_user(ptr_to_compat(edid), &up->edid) ||
+	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
 	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
 		return -EFAULT;
 	return 0;
-- 
2.14.3

[PATCH 5/5] media: v4l2-compat-ioctl32: better name userspace pointers

[Mauro Carvalho Chehab]

In the past, "up" were an acronym for "user pointer" and "kp" for
"kernel pointer". However, since a1dfb4c48cc1 ("media:
v4l2-compat-ioctl32.c: refactor compat ioctl32 logic"), both
are now __user pointers.

So, the usage of "kp" is really misleading there. So, rename
both to just "p32" and "p64" everywhere it occurs, in order to
make peace with this file's namespace.

There are two exceptions to "up/kp" nomenclature: at
alloc_userspace() and at do_video_ioctl().

There, a new userspace pointer were allocated, in order to store
the 64 bits version of the ioctl. Those were called as "up_native",
with is, IMHO, an even worse name, as "native" could mislead of
being the arguments that were filled from userspace. I almost
renamed it to just "p64", but, after thinking more about that,
it sounded better to call it as "new_p64", as this makes clearer
that this is the data structure that was allocated inside this
file in order to be used to pass/retrieve data when calling the
64-bit ready file->f_op->unlocked_ioctl() function.

Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Suggested-by: Hans Verkuil <hverkuil@xs4all.nl>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
---
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 588 +++++++++++++-------------
 1 file changed, 294 insertions(+), 294 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index c951ac3faf46..8c05dd9660d3 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -56,8 +56,8 @@ struct v4l2_window32 {
 	__u8                    global_alpha;
 };
 
-static int get_v4l2_window32(struct v4l2_window __user *kp,
-			     struct v4l2_window32 __user *up,
+static int get_v4l2_window32(struct v4l2_window __user *p64,
+			     struct v4l2_window32 __user *p32,
 			     void __user *aux_buf, u32 aux_space)
 {
 	struct v4l2_clip32 __user *uclips;
@@ -65,26 +65,26 @@ static int get_v4l2_window32(struct v4l2_window __user *kp,
 	compat_caddr_t p;
 	u32 clipcount;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    copy_in_user(&kp->w, &up->w, sizeof(up->w)) ||
-	    assign_in_user(&kp->field, &up->field) ||
-	    assign_in_user(&kp->chromakey, &up->chromakey) ||
-	    assign_in_user(&kp->global_alpha, &up->global_alpha) ||
-	    get_user(clipcount, &up->clipcount) ||
-	    put_user(clipcount, &kp->clipcount))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    copy_in_user(&p64->w, &p32->w, sizeof(p32->w)) ||
+	    assign_in_user(&p64->field, &p32->field) ||
+	    assign_in_user(&p64->chromakey, &p32->chromakey) ||
+	    assign_in_user(&p64->global_alpha, &p32->global_alpha) ||
+	    get_user(clipcount, &p32->clipcount) ||
+	    put_user(clipcount, &p64->clipcount))
 		return -EFAULT;
 	if (clipcount > 2048)
 		return -EINVAL;
 	if (!clipcount)
-		return put_user(NULL, &kp->clips);
+		return put_user(NULL, &p64->clips);
 
-	if (get_user(p, &up->clips))
+	if (get_user(p, &p32->clips))
 		return -EFAULT;
 	uclips = compat_ptr(p);
 	if (aux_space < clipcount * sizeof(*kclips))
 		return -EFAULT;
 	kclips = aux_buf;
-	if (put_user(kclips, &kp->clips))
+	if (put_user(kclips, &p64->clips))
 		return -EFAULT;
 
 	while (clipcount--) {
@@ -98,27 +98,27 @@ static int get_v4l2_window32(struct v4l2_window __user *kp,
 	return 0;
 }
 
-static int put_v4l2_window32(struct v4l2_window __user *kp,
-			     struct v4l2_window32 __user *up)
+static int put_v4l2_window32(struct v4l2_window __user *p64,
+			     struct v4l2_window32 __user *p32)
 {
 	struct v4l2_clip __user *kclips;
 	struct v4l2_clip32 __user *uclips;
 	compat_caddr_t p;
 	u32 clipcount;
 
-	if (copy_in_user(&up->w, &kp->w, sizeof(kp->w)) ||
-	    assign_in_user(&up->field, &kp->field) ||
-	    assign_in_user(&up->chromakey, &kp->chromakey) ||
-	    assign_in_user(&up->global_alpha, &kp->global_alpha) ||
-	    get_user(clipcount, &kp->clipcount) ||
-	    put_user(clipcount, &up->clipcount))
+	if (copy_in_user(&p32->w, &p64->w, sizeof(p64->w)) ||
+	    assign_in_user(&p32->field, &p64->field) ||
+	    assign_in_user(&p32->chromakey, &p64->chromakey) ||
+	    assign_in_user(&p32->global_alpha, &p64->global_alpha) ||
+	    get_user(clipcount, &p64->clipcount) ||
+	    put_user(clipcount, &p32->clipcount))
 		return -EFAULT;
 	if (!clipcount)
 		return 0;
 
-	if (get_user(kclips, &kp->clips))
+	if (get_user(kclips, &p64->clips))
 		return -EFAULT;
-	if (get_user(p, &up->clips))
+	if (get_user(p, &p32->clips))
 		return -EFAULT;
 	uclips = compat_ptr(p);
 	while (clipcount--) {
@@ -161,11 +161,11 @@ struct v4l2_create_buffers32 {
 	__u32			reserved[8];
 };
 
-static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
+static int __bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
 {
 	u32 type;
 
-	if (get_user(type, &up->type))
+	if (get_user(type, &p32->type))
 		return -EFAULT;
 
 	switch (type) {
@@ -173,7 +173,7 @@ static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: {
 		u32 clipcount;
 
-		if (get_user(clipcount, &up->fmt.win.clipcount))
+		if (get_user(clipcount, &p32->fmt.win.clipcount))
 			return -EFAULT;
 		if (clipcount > 2048)
 			return -EINVAL;
@@ -186,141 +186,141 @@ static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
 	}
 }
 
-static int bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
+static int bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
 {
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)))
 		return -EFAULT;
-	return __bufsize_v4l2_format(up, size);
+	return __bufsize_v4l2_format(p32, size);
 }
 
-static int __get_v4l2_format32(struct v4l2_format __user *kp,
-			       struct v4l2_format32 __user *up,
+static int __get_v4l2_format32(struct v4l2_format __user *p64,
+			       struct v4l2_format32 __user *p32,
 			       void __user *aux_buf, u32 aux_space)
 {
 	u32 type;
 
-	if (get_user(type, &up->type) || put_user(type, &kp->type))
+	if (get_user(type, &p32->type) || put_user(type, &p64->type))
 		return -EFAULT;
 
 	switch (type) {
 	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
-		return copy_in_user(&kp->fmt.pix, &up->fmt.pix,
-				    sizeof(kp->fmt.pix)) ? -EFAULT : 0;
+		return copy_in_user(&p64->fmt.pix, &p32->fmt.pix,
+				    sizeof(p64->fmt.pix)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
-		return copy_in_user(&kp->fmt.pix_mp, &up->fmt.pix_mp,
-				    sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0;
+		return copy_in_user(&p64->fmt.pix_mp, &p32->fmt.pix_mp,
+				    sizeof(p64->fmt.pix_mp)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_VIDEO_OVERLAY:
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
-		return get_v4l2_window32(&kp->fmt.win, &up->fmt.win,
+		return get_v4l2_window32(&p64->fmt.win, &p32->fmt.win,
 					 aux_buf, aux_space);
 	case V4L2_BUF_TYPE_VBI_CAPTURE:
 	case V4L2_BUF_TYPE_VBI_OUTPUT:
-		return copy_in_user(&kp->fmt.vbi, &up->fmt.vbi,
-				    sizeof(kp->fmt.vbi)) ? -EFAULT : 0;
+		return copy_in_user(&p64->fmt.vbi, &p32->fmt.vbi,
+				    sizeof(p64->fmt.vbi)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
 	case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
-		return copy_in_user(&kp->fmt.sliced, &up->fmt.sliced,
-				    sizeof(kp->fmt.sliced)) ? -EFAULT : 0;
+		return copy_in_user(&p64->fmt.sliced, &p32->fmt.sliced,
+				    sizeof(p64->fmt.sliced)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_SDR_CAPTURE:
 	case V4L2_BUF_TYPE_SDR_OUTPUT:
-		return copy_in_user(&kp->fmt.sdr, &up->fmt.sdr,
-				    sizeof(kp->fmt.sdr)) ? -EFAULT : 0;
+		return copy_in_user(&p64->fmt.sdr, &p32->fmt.sdr,
+				    sizeof(p64->fmt.sdr)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_META_CAPTURE:
-		return copy_in_user(&kp->fmt.meta, &up->fmt.meta,
-				    sizeof(kp->fmt.meta)) ? -EFAULT : 0;
+		return copy_in_user(&p64->fmt.meta, &p32->fmt.meta,
+				    sizeof(p64->fmt.meta)) ? -EFAULT : 0;
 	default:
 		return -EINVAL;
 	}
 }
 
-static int get_v4l2_format32(struct v4l2_format __user *kp,
-			     struct v4l2_format32 __user *up,
+static int get_v4l2_format32(struct v4l2_format __user *p64,
+			     struct v4l2_format32 __user *p32,
 			     void __user *aux_buf, u32 aux_space)
 {
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)))
 		return -EFAULT;
-	return __get_v4l2_format32(kp, up, aux_buf, aux_space);
+	return __get_v4l2_format32(p64, p32, aux_buf, aux_space);
 }
 
-static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *up,
+static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *p32,
 			       u32 *size)
 {
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)))
 		return -EFAULT;
-	return __bufsize_v4l2_format(&up->format, size);
+	return __bufsize_v4l2_format(&p32->format, size);
 }
 
-static int get_v4l2_create32(struct v4l2_create_buffers __user *kp,
-			     struct v4l2_create_buffers32 __user *up,
+static int get_v4l2_create32(struct v4l2_create_buffers __user *p64,
+			     struct v4l2_create_buffers32 __user *p32,
 			     void __user *aux_buf, u32 aux_space)
 {
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    copy_in_user(kp, up,
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    copy_in_user(p64, p32,
 			 offsetof(struct v4l2_create_buffers32, format)))
 		return -EFAULT;
-	return __get_v4l2_format32(&kp->format, &up->format,
+	return __get_v4l2_format32(&p64->format, &p32->format,
 				   aux_buf, aux_space);
 }
 
-static int __put_v4l2_format32(struct v4l2_format __user *kp,
-			       struct v4l2_format32 __user *up)
+static int __put_v4l2_format32(struct v4l2_format __user *p64,
+			       struct v4l2_format32 __user *p32)
 {
 	u32 type;
 
-	if (get_user(type, &kp->type))
+	if (get_user(type, &p64->type))
 		return -EFAULT;
 
 	switch (type) {
 	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
-		return copy_in_user(&up->fmt.pix, &kp->fmt.pix,
-				    sizeof(kp->fmt.pix)) ? -EFAULT : 0;
+		return copy_in_user(&p32->fmt.pix, &p64->fmt.pix,
+				    sizeof(p64->fmt.pix)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
-		return copy_in_user(&up->fmt.pix_mp, &kp->fmt.pix_mp,
-				    sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0;
+		return copy_in_user(&p32->fmt.pix_mp, &p64->fmt.pix_mp,
+				    sizeof(p64->fmt.pix_mp)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_VIDEO_OVERLAY:
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
-		return put_v4l2_window32(&kp->fmt.win, &up->fmt.win);
+		return put_v4l2_window32(&p64->fmt.win, &p32->fmt.win);
 	case V4L2_BUF_TYPE_VBI_CAPTURE:
 	case V4L2_BUF_TYPE_VBI_OUTPUT:
-		return copy_in_user(&up->fmt.vbi, &kp->fmt.vbi,
-				    sizeof(kp->fmt.vbi)) ? -EFAULT : 0;
+		return copy_in_user(&p32->fmt.vbi, &p64->fmt.vbi,
+				    sizeof(p64->fmt.vbi)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
 	case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
-		return copy_in_user(&up->fmt.sliced, &kp->fmt.sliced,
-				    sizeof(kp->fmt.sliced)) ? -EFAULT : 0;
+		return copy_in_user(&p32->fmt.sliced, &p64->fmt.sliced,
+				    sizeof(p64->fmt.sliced)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_SDR_CAPTURE:
 	case V4L2_BUF_TYPE_SDR_OUTPUT:
-		return copy_in_user(&up->fmt.sdr, &kp->fmt.sdr,
-				    sizeof(kp->fmt.sdr)) ? -EFAULT : 0;
+		return copy_in_user(&p32->fmt.sdr, &p64->fmt.sdr,
+				    sizeof(p64->fmt.sdr)) ? -EFAULT : 0;
 	case V4L2_BUF_TYPE_META_CAPTURE:
-		return copy_in_user(&up->fmt.meta, &kp->fmt.meta,
-				    sizeof(kp->fmt.meta)) ? -EFAULT : 0;
+		return copy_in_user(&p32->fmt.meta, &p64->fmt.meta,
+				    sizeof(p64->fmt.meta)) ? -EFAULT : 0;
 	default:
 		return -EINVAL;
 	}
 }
 
-static int put_v4l2_format32(struct v4l2_format __user *kp,
-			     struct v4l2_format32 __user *up)
+static int put_v4l2_format32(struct v4l2_format __user *p64,
+			     struct v4l2_format32 __user *p32)
 {
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)))
 		return -EFAULT;
-	return __put_v4l2_format32(kp, up);
+	return __put_v4l2_format32(p64, p32);
 }
 
-static int put_v4l2_create32(struct v4l2_create_buffers __user *kp,
-			     struct v4l2_create_buffers32 __user *up)
+static int put_v4l2_create32(struct v4l2_create_buffers __user *p64,
+			     struct v4l2_create_buffers32 __user *p32)
 {
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    copy_in_user(up, kp,
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    copy_in_user(p32, p64,
 			 offsetof(struct v4l2_create_buffers32, format)) ||
-	    copy_in_user(up->reserved, kp->reserved, sizeof(kp->reserved)))
+	    copy_in_user(p32->reserved, p64->reserved, sizeof(p64->reserved)))
 		return -EFAULT;
-	return __put_v4l2_format32(&kp->format, &up->format);
+	return __put_v4l2_format32(&p64->format, &p32->format);
 }
 
 struct v4l2_standard32 {
@@ -332,27 +332,27 @@ struct v4l2_standard32 {
 	__u32		     reserved[4];
 };
 
-static int get_v4l2_standard32(struct v4l2_standard __user *kp,
-			       struct v4l2_standard32 __user *up)
+static int get_v4l2_standard32(struct v4l2_standard __user *p64,
+			       struct v4l2_standard32 __user *p32)
 {
 	/* other fields are not set by the user, nor used by the driver */
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    assign_in_user(&kp->index, &up->index))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    assign_in_user(&p64->index, &p32->index))
 		return -EFAULT;
 	return 0;
 }
 
-static int put_v4l2_standard32(struct v4l2_standard __user *kp,
-			       struct v4l2_standard32 __user *up)
+static int put_v4l2_standard32(struct v4l2_standard __user *p64,
+			       struct v4l2_standard32 __user *p32)
 {
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    assign_in_user(&up->index, &kp->index) ||
-	    assign_in_user(&up->id, &kp->id) ||
-	    copy_in_user(up->name, kp->name, sizeof(up->name)) ||
-	    copy_in_user(&up->frameperiod, &kp->frameperiod,
-			 sizeof(up->frameperiod)) ||
-	    assign_in_user(&up->framelines, &kp->framelines) ||
-	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    assign_in_user(&p32->index, &p64->index) ||
+	    assign_in_user(&p32->id, &p64->id) ||
+	    copy_in_user(p32->name, p64->name, sizeof(p32->name)) ||
+	    copy_in_user(&p32->frameperiod, &p64->frameperiod,
+			 sizeof(p32->frameperiod)) ||
+	    assign_in_user(&p32->framelines, &p64->framelines) ||
+	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)))
 		return -EFAULT;
 	return 0;
 }
@@ -392,31 +392,31 @@ struct v4l2_buffer32 {
 	__u32			reserved;
 };
 
-static int get_v4l2_plane32(struct v4l2_plane __user *up,
-			    struct v4l2_plane32 __user *up32,
+static int get_v4l2_plane32(struct v4l2_plane __user *p64,
+			    struct v4l2_plane32 __user *p32,
 			    enum v4l2_memory memory)
 {
 	compat_ulong_t p;
 
-	if (copy_in_user(up, up32, 2 * sizeof(__u32)) ||
-	    copy_in_user(&up->data_offset, &up32->data_offset,
-			 sizeof(up->data_offset)))
+	if (copy_in_user(p64, p32, 2 * sizeof(__u32)) ||
+	    copy_in_user(&p64->data_offset, &p32->data_offset,
+			 sizeof(p64->data_offset)))
 		return -EFAULT;
 
 	switch (memory) {
 	case V4L2_MEMORY_MMAP:
 	case V4L2_MEMORY_OVERLAY:
-		if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
-				 sizeof(up32->m.mem_offset)))
+		if (copy_in_user(&p64->m.mem_offset, &p32->m.mem_offset,
+				 sizeof(p32->m.mem_offset)))
 			return -EFAULT;
 		break;
 	case V4L2_MEMORY_USERPTR:
-		if (get_user(p, &up32->m.userptr) ||
-		    put_user((unsigned long)compat_ptr(p), &up->m.userptr))
+		if (get_user(p, &p32->m.userptr) ||
+		    put_user((unsigned long)compat_ptr(p), &p64->m.userptr))
 			return -EFAULT;
 		break;
 	case V4L2_MEMORY_DMABUF:
-		if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd)))
+		if (copy_in_user(&p64->m.fd, &p32->m.fd, sizeof(p32->m.fd)))
 			return -EFAULT;
 		break;
 	}
@@ -424,32 +424,32 @@ static int get_v4l2_plane32(struct v4l2_plane __user *up,
 	return 0;
 }
 
-static int put_v4l2_plane32(struct v4l2_plane __user *up,
-			    struct v4l2_plane32 __user *up32,
+static int put_v4l2_plane32(struct v4l2_plane __user *p64,
+			    struct v4l2_plane32 __user *p32,
 			    enum v4l2_memory memory)
 {
 	unsigned long p;
 
-	if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
-	    copy_in_user(&up32->data_offset, &up->data_offset,
-			 sizeof(up->data_offset)))
+	if (copy_in_user(p32, p64, 2 * sizeof(__u32)) ||
+	    copy_in_user(&p32->data_offset, &p64->data_offset,
+			 sizeof(p64->data_offset)))
 		return -EFAULT;
 
 	switch (memory) {
 	case V4L2_MEMORY_MMAP:
 	case V4L2_MEMORY_OVERLAY:
-		if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
-				 sizeof(up->m.mem_offset)))
+		if (copy_in_user(&p32->m.mem_offset, &p64->m.mem_offset,
+				 sizeof(p64->m.mem_offset)))
 			return -EFAULT;
 		break;
 	case V4L2_MEMORY_USERPTR:
-		if (get_user(p, &up->m.userptr)||
+		if (get_user(p, &p64->m.userptr)||
 		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
-			     &up32->m.userptr))
+			     &p32->m.userptr))
 			return -EFAULT;
 		break;
 	case V4L2_MEMORY_DMABUF:
-		if (copy_in_user(&up32->m.fd, &up->m.fd, sizeof(up->m.fd)))
+		if (copy_in_user(&p32->m.fd, &p64->m.fd, sizeof(p64->m.fd)))
 			return -EFAULT;
 		break;
 	}
@@ -457,14 +457,14 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
 	return 0;
 }
 
-static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *up, u32 *size)
+static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *p32, u32 *size)
 {
 	u32 type;
 	u32 length;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    get_user(type, &up->type) ||
-	    get_user(length, &up->length))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    get_user(type, &p32->type) ||
+	    get_user(length, &p32->length))
 		return -EFAULT;
 
 	if (V4L2_TYPE_IS_MULTIPLANAR(type)) {
@@ -482,8 +482,8 @@ static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *up, u32 *size)
 	return 0;
 }
 
-static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
-			     struct v4l2_buffer32 __user *up,
+static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
+			     struct v4l2_buffer32 __user *p32,
 			     void __user *aux_buf, u32 aux_space)
 {
 	u32 type;
@@ -494,24 +494,24 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
 	compat_caddr_t p;
 	int ret;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    assign_in_user(&kp->index, &up->index) ||
-	    get_user(type, &up->type) ||
-	    put_user(type, &kp->type) ||
-	    assign_in_user(&kp->flags, &up->flags) ||
-	    get_user(memory, &up->memory) ||
-	    put_user(memory, &kp->memory) ||
-	    get_user(length, &up->length) ||
-	    put_user(length, &kp->length))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    assign_in_user(&p64->index, &p32->index) ||
+	    get_user(type, &p32->type) ||
+	    put_user(type, &p64->type) ||
+	    assign_in_user(&p64->flags, &p32->flags) ||
+	    get_user(memory, &p32->memory) ||
+	    put_user(memory, &p64->memory) ||
+	    get_user(length, &p32->length) ||
+	    put_user(length, &p64->length))
 		return -EFAULT;
 
 	if (V4L2_TYPE_IS_OUTPUT(type))
-		if (assign_in_user(&kp->bytesused, &up->bytesused) ||
-		    assign_in_user(&kp->field, &up->field) ||
-		    assign_in_user(&kp->timestamp.tv_sec,
-				   &up->timestamp.tv_sec) ||
-		    assign_in_user(&kp->timestamp.tv_usec,
-				   &up->timestamp.tv_usec))
+		if (assign_in_user(&p64->bytesused, &p32->bytesused) ||
+		    assign_in_user(&p64->field, &p32->field) ||
+		    assign_in_user(&p64->timestamp.tv_sec,
+				   &p32->timestamp.tv_sec) ||
+		    assign_in_user(&p64->timestamp.tv_usec,
+				   &p32->timestamp.tv_usec))
 			return -EFAULT;
 
 	if (V4L2_TYPE_IS_MULTIPLANAR(type)) {
@@ -522,12 +522,12 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
 			 * num_planes == 0 is legal, e.g. when userspace doesn't
 			 * need planes array on DQBUF
 			 */
-			return put_user(NULL, &kp->m.planes);
+			return put_user(NULL, &p64->m.planes);
 		}
 		if (num_planes > VIDEO_MAX_PLANES)
 			return -EINVAL;
 
-		if (get_user(p, &up->m.planes))
+		if (get_user(p, &p32->m.planes))
 			return -EFAULT;
 
 		uplane32 = compat_ptr(p);
@@ -544,7 +544,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
 
 		uplane = aux_buf;
 		if (put_user((__force struct v4l2_plane *)uplane,
-			     &kp->m.planes))
+			     &p64->m.planes))
 			return -EFAULT;
 
 		while (num_planes--) {
@@ -558,20 +558,20 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
 		switch (memory) {
 		case V4L2_MEMORY_MMAP:
 		case V4L2_MEMORY_OVERLAY:
-			if (assign_in_user(&kp->m.offset, &up->m.offset))
+			if (assign_in_user(&p64->m.offset, &p32->m.offset))
 				return -EFAULT;
 			break;
 		case V4L2_MEMORY_USERPTR: {
 			compat_ulong_t userptr;
 
-			if (get_user(userptr, &up->m.userptr) ||
+			if (get_user(userptr, &p32->m.userptr) ||
 			    put_user((unsigned long)compat_ptr(userptr),
-				     &kp->m.userptr))
+				     &p64->m.userptr))
 				return -EFAULT;
 			break;
 		}
 		case V4L2_MEMORY_DMABUF:
-			if (assign_in_user(&kp->m.fd, &up->m.fd))
+			if (assign_in_user(&p64->m.fd, &p32->m.fd))
 				return -EFAULT;
 			break;
 		}
@@ -580,8 +580,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
 	return 0;
 }
 
-static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
-			     struct v4l2_buffer32 __user *up)
+static int put_v4l2_buffer32(struct v4l2_buffer __user *p64,
+			     struct v4l2_buffer32 __user *p32)
 {
 	u32 type;
 	u32 length;
@@ -591,25 +591,25 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
 	compat_caddr_t p;
 	int ret;
 
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    assign_in_user(&up->index, &kp->index) ||
-	    get_user(type, &kp->type) ||
-	    put_user(type, &up->type) ||
-	    assign_in_user(&up->flags, &kp->flags) ||
-	    get_user(memory, &kp->memory) ||
-	    put_user(memory, &up->memory))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    assign_in_user(&p32->index, &p64->index) ||
+	    get_user(type, &p64->type) ||
+	    put_user(type, &p32->type) ||
+	    assign_in_user(&p32->flags, &p64->flags) ||
+	    get_user(memory, &p64->memory) ||
+	    put_user(memory, &p32->memory))
 		return -EFAULT;
 
-	if (assign_in_user(&up->bytesused, &kp->bytesused) ||
-	    assign_in_user(&up->field, &kp->field) ||
-	    assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) ||
-	    assign_in_user(&up->timestamp.tv_usec, &kp->timestamp.tv_usec) ||
-	    copy_in_user(&up->timecode, &kp->timecode, sizeof(kp->timecode)) ||
-	    assign_in_user(&up->sequence, &kp->sequence) ||
-	    assign_in_user(&up->reserved2, &kp->reserved2) ||
-	    assign_in_user(&up->reserved, &kp->reserved) ||
-	    get_user(length, &kp->length) ||
-	    put_user(length, &up->length))
+	if (assign_in_user(&p32->bytesused, &p64->bytesused) ||
+	    assign_in_user(&p32->field, &p64->field) ||
+	    assign_in_user(&p32->timestamp.tv_sec, &p64->timestamp.tv_sec) ||
+	    assign_in_user(&p32->timestamp.tv_usec, &p64->timestamp.tv_usec) ||
+	    copy_in_user(&p32->timecode, &p64->timecode, sizeof(p64->timecode)) ||
+	    assign_in_user(&p32->sequence, &p64->sequence) ||
+	    assign_in_user(&p32->reserved2, &p64->reserved2) ||
+	    assign_in_user(&p32->reserved, &p64->reserved) ||
+	    get_user(length, &p64->length) ||
+	    put_user(length, &p32->length))
 		return -EFAULT;
 
 	if (V4L2_TYPE_IS_MULTIPLANAR(type)) {
@@ -625,9 +625,9 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
 		 * smatch warnings, so instead declare it without __user
 		 * and cast it as a userspace pointer to put_v4l2_plane32().
 		 */
-		if (get_user(uplane, &kp->m.planes))
+		if (get_user(uplane, &p64->m.planes))
 			return -EFAULT;
-		if (get_user(p, &up->m.planes))
+		if (get_user(p, &p32->m.planes))
 			return -EFAULT;
 		uplane32 = compat_ptr(p);
 
@@ -642,15 +642,15 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
 		switch (memory) {
 		case V4L2_MEMORY_MMAP:
 		case V4L2_MEMORY_OVERLAY:
-			if (assign_in_user(&up->m.offset, &kp->m.offset))
+			if (assign_in_user(&p32->m.offset, &p64->m.offset))
 				return -EFAULT;
 			break;
 		case V4L2_MEMORY_USERPTR:
-			if (assign_in_user(&up->m.userptr, &kp->m.userptr))
+			if (assign_in_user(&p32->m.userptr, &p64->m.userptr))
 				return -EFAULT;
 			break;
 		case V4L2_MEMORY_DMABUF:
-			if (assign_in_user(&up->m.fd, &kp->m.fd))
+			if (assign_in_user(&p32->m.fd, &p64->m.fd))
 				return -EFAULT;
 			break;
 		}
@@ -675,32 +675,32 @@ struct v4l2_framebuffer32 {
 	} fmt;
 };
 
-static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
-				  struct v4l2_framebuffer32 __user *up)
+static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
+				  struct v4l2_framebuffer32 __user *p32)
 {
 	compat_caddr_t tmp;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    get_user(tmp, &up->base) ||
-	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
-	    assign_in_user(&kp->capability, &up->capability) ||
-	    assign_in_user(&kp->flags, &up->flags) ||
-	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    get_user(tmp, &p32->base) ||
+	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
+	    assign_in_user(&p64->capability, &p32->capability) ||
+	    assign_in_user(&p64->flags, &p32->flags) ||
+	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
 		return -EFAULT;
 	return 0;
 }
 
-static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
-				  struct v4l2_framebuffer32 __user *up)
+static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
+				  struct v4l2_framebuffer32 __user *p32)
 {
 	void *base;
 
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    get_user(base, &kp->base) ||
-	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
-	    assign_in_user(&up->capability, &kp->capability) ||
-	    assign_in_user(&up->flags, &kp->flags) ||
-	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    get_user(base, &p64->base) ||
+	    put_user(ptr_to_compat((void __user *)base), &p32->base) ||
+	    assign_in_user(&p32->capability, &p64->capability) ||
+	    assign_in_user(&p32->flags, &p64->flags) ||
+	    copy_in_user(&p32->fmt, &p64->fmt, sizeof(p64->fmt)))
 		return -EFAULT;
 	return 0;
 }
@@ -721,18 +721,18 @@ struct v4l2_input32 {
  * The 64-bit v4l2_input struct has extra padding at the end of the struct.
  * Otherwise it is identical to the 32-bit version.
  */
-static inline int get_v4l2_input32(struct v4l2_input __user *kp,
-				   struct v4l2_input32 __user *up)
+static inline int get_v4l2_input32(struct v4l2_input __user *p64,
+				   struct v4l2_input32 __user *p32)
 {
-	if (copy_in_user(kp, up, sizeof(*up)))
+	if (copy_in_user(p64, p32, sizeof(*p32)))
 		return -EFAULT;
 	return 0;
 }
 
-static inline int put_v4l2_input32(struct v4l2_input __user *kp,
-				   struct v4l2_input32 __user *up)
+static inline int put_v4l2_input32(struct v4l2_input __user *p64,
+				   struct v4l2_input32 __user *p32)
 {
-	if (copy_in_user(up, kp, sizeof(*up)))
+	if (copy_in_user(p32, p64, sizeof(*p32)))
 		return -EFAULT;
 	return 0;
 }
@@ -786,13 +786,13 @@ static inline bool ctrl_is_pointer(struct file *file, u32 id)
 		(qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD);
 }
 
-static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *up,
+static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *p32,
 				     u32 *size)
 {
 	u32 count;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    get_user(count, &up->count))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    get_user(count, &p32->count))
 		return -EFAULT;
 	if (count > V4L2_CID_MAX_CTRLS)
 		return -EINVAL;
@@ -801,8 +801,8 @@ static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *up,
 }
 
 static int get_v4l2_ext_controls32(struct file *file,
-				   struct v4l2_ext_controls __user *kp,
-				   struct v4l2_ext_controls32 __user *up,
+				   struct v4l2_ext_controls __user *p64,
+				   struct v4l2_ext_controls32 __user *p32,
 				   void __user *aux_buf, u32 aux_space)
 {
 	struct v4l2_ext_control32 __user *ucontrols;
@@ -811,19 +811,19 @@ static int get_v4l2_ext_controls32(struct file *file,
 	u32 n;
 	compat_caddr_t p;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    assign_in_user(&kp->which, &up->which) ||
-	    get_user(count, &up->count) ||
-	    put_user(count, &kp->count) ||
-	    assign_in_user(&kp->error_idx, &up->error_idx) ||
-	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    assign_in_user(&p64->which, &p32->which) ||
+	    get_user(count, &p32->count) ||
+	    put_user(count, &p64->count) ||
+	    assign_in_user(&p64->error_idx, &p32->error_idx) ||
+	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
 		return -EFAULT;
 
 	if (count == 0)
-		return put_user(NULL, &kp->controls);
+		return put_user(NULL, &p64->controls);
 	if (count > V4L2_CID_MAX_CTRLS)
 		return -EINVAL;
-	if (get_user(p, &up->controls))
+	if (get_user(p, &p32->controls))
 		return -EFAULT;
 	ucontrols = compat_ptr(p);
 	if (!access_ok(VERIFY_READ, ucontrols, count * sizeof(*ucontrols)))
@@ -832,7 +832,7 @@ static int get_v4l2_ext_controls32(struct file *file,
 		return -EFAULT;
 	kcontrols = aux_buf;
 	if (put_user((__force struct v4l2_ext_control *)kcontrols,
-		     &kp->controls))
+		     &p64->controls))
 		return -EFAULT;
 
 	for (n = 0; n < count; n++) {
@@ -860,8 +860,8 @@ static int get_v4l2_ext_controls32(struct file *file,
 }
 
 static int put_v4l2_ext_controls32(struct file *file,
-				   struct v4l2_ext_controls __user *kp,
-				   struct v4l2_ext_controls32 __user *up)
+				   struct v4l2_ext_controls __user *p64,
+				   struct v4l2_ext_controls32 __user *p32)
 {
 	struct v4l2_ext_control32 __user *ucontrols;
 	struct v4l2_ext_control *kcontrols;
@@ -877,18 +877,18 @@ static int put_v4l2_ext_controls32(struct file *file,
 	 * with __user causes smatch warnings, so instead declare it
 	 * without __user and cast it as a userspace pointer where needed.
 	 */
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    assign_in_user(&up->which, &kp->which) ||
-	    get_user(count, &kp->count) ||
-	    put_user(count, &up->count) ||
-	    assign_in_user(&up->error_idx, &kp->error_idx) ||
-	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)) ||
-	    get_user(kcontrols, &kp->controls))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    assign_in_user(&p32->which, &p64->which) ||
+	    get_user(count, &p64->count) ||
+	    put_user(count, &p32->count) ||
+	    assign_in_user(&p32->error_idx, &p64->error_idx) ||
+	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)) ||
+	    get_user(kcontrols, &p64->controls))
 		return -EFAULT;
 
 	if (!count || count > (U32_MAX/sizeof(*ucontrols)))
 		return 0;
-	if (get_user(p, &up->controls))
+	if (get_user(p, &p32->controls))
 		return -EFAULT;
 	ucontrols = compat_ptr(p);
 	if (!access_ok(VERIFY_WRITE, ucontrols, count * sizeof(*ucontrols)))
@@ -938,18 +938,18 @@ struct v4l2_event32 {
 	__u32				reserved[8];
 };
 
-static int put_v4l2_event32(struct v4l2_event __user *kp,
-			    struct v4l2_event32 __user *up)
+static int put_v4l2_event32(struct v4l2_event __user *p64,
+			    struct v4l2_event32 __user *p32)
 {
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    assign_in_user(&up->type, &kp->type) ||
-	    copy_in_user(&up->u, &kp->u, sizeof(kp->u)) ||
-	    assign_in_user(&up->pending, &kp->pending) ||
-	    assign_in_user(&up->sequence, &kp->sequence) ||
-	    assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) ||
-	    assign_in_user(&up->timestamp.tv_nsec, &kp->timestamp.tv_nsec) ||
-	    assign_in_user(&up->id, &kp->id) ||
-	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    assign_in_user(&p32->type, &p64->type) ||
+	    copy_in_user(&p32->u, &p64->u, sizeof(p64->u)) ||
+	    assign_in_user(&p32->pending, &p64->pending) ||
+	    assign_in_user(&p32->sequence, &p64->sequence) ||
+	    assign_in_user(&p32->timestamp.tv_sec, &p64->timestamp.tv_sec) ||
+	    assign_in_user(&p32->timestamp.tv_nsec, &p64->timestamp.tv_nsec) ||
+	    assign_in_user(&p32->id, &p64->id) ||
+	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)))
 		return -EFAULT;
 	return 0;
 }
@@ -962,35 +962,35 @@ struct v4l2_edid32 {
 	compat_caddr_t edid;
 };
 
-static int get_v4l2_edid32(struct v4l2_edid __user *kp,
-			   struct v4l2_edid32 __user *up)
+static int get_v4l2_edid32(struct v4l2_edid __user *p64,
+			   struct v4l2_edid32 __user *p32)
 {
 	compat_uptr_t tmp;
 
-	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
-	    assign_in_user(&kp->pad, &up->pad) ||
-	    assign_in_user(&kp->start_block, &up->start_block) ||
-	    assign_in_user(&kp->blocks,
-			   (unsigned char __user *)&up->blocks) ||
-	    get_user(tmp, &up->edid) ||
-	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
-	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
+	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
+	    assign_in_user(&p64->pad, &p32->pad) ||
+	    assign_in_user(&p64->start_block, &p32->start_block) ||
+	    assign_in_user(&p64->blocks,
+			   (unsigned char __user *)&p32->blocks) ||
+	    get_user(tmp, &p32->edid) ||
+	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
+	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
 		return -EFAULT;
 	return 0;
 }
 
-static int put_v4l2_edid32(struct v4l2_edid __user *kp,
-			   struct v4l2_edid32 __user *up)
+static int put_v4l2_edid32(struct v4l2_edid __user *p64,
+			   struct v4l2_edid32 __user *p32)
 {
 	void *edid;
 
-	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
-	    assign_in_user(&up->pad, &kp->pad) ||
-	    assign_in_user(&up->start_block, &kp->start_block) ||
-	    assign_in_user(&up->blocks, &kp->blocks) ||
-	    get_user(edid, &kp->edid) ||
-	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
-	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
+	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
+	    assign_in_user(&p32->pad, &p64->pad) ||
+	    assign_in_user(&p32->start_block, &p64->start_block) ||
+	    assign_in_user(&p32->blocks, &p64->blocks) ||
+	    get_user(edid, &p64->edid) ||
+	    put_user(ptr_to_compat((void __user *)edid), &p32->edid) ||
+	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)))
 		return -EFAULT;
 	return 0;
 }
@@ -1024,20 +1024,20 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
 #define VIDIOC_S_OUTPUT32	_IOWR('V', 47, s32)
 
 static int alloc_userspace(unsigned int size, u32 aux_space,
-			   void __user **up_native)
+			   void __user **new_p64)
 {
-	*up_native = compat_alloc_user_space(size + aux_space);
-	if (!*up_native)
+	*new_p64 = compat_alloc_user_space(size + aux_space);
+	if (!*new_p64)
 		return -ENOMEM;
-	if (clear_user(*up_native, size))
+	if (clear_user(*new_p64, size))
 		return -EFAULT;
 	return 0;
 }
 
 static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-	void __user *up = compat_ptr(arg);
-	void __user *up_native = NULL;
+	void __user *p32 = compat_ptr(arg);
+	void __user *new_p64 = NULL;
 	void __user *aux_buf;
 	u32 aux_space;
 	int compatible_arg = 1;
@@ -1078,50 +1078,50 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 	case VIDIOC_STREAMOFF:
 	case VIDIOC_S_INPUT:
 	case VIDIOC_S_OUTPUT:
-		err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
-		if (!err && assign_in_user((unsigned int __user *)up_native,
-					   (compat_uint_t __user *)up))
+		err = alloc_userspace(sizeof(unsigned int), 0, &new_p64);
+		if (!err && assign_in_user((unsigned int __user *)new_p64,
+					   (compat_uint_t __user *)p32))
 			err = -EFAULT;
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_G_INPUT:
 	case VIDIOC_G_OUTPUT:
-		err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
+		err = alloc_userspace(sizeof(unsigned int), 0, &new_p64);
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_G_EDID:
 	case VIDIOC_S_EDID:
-		err = alloc_userspace(sizeof(struct v4l2_edid), 0, &up_native);
+		err = alloc_userspace(sizeof(struct v4l2_edid), 0, &new_p64);
 		if (!err)
-			err = get_v4l2_edid32(up_native, up);
+			err = get_v4l2_edid32(new_p64, p32);
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_G_FMT:
 	case VIDIOC_S_FMT:
 	case VIDIOC_TRY_FMT:
-		err = bufsize_v4l2_format(up, &aux_space);
+		err = bufsize_v4l2_format(p32, &aux_space);
 		if (!err)
 			err = alloc_userspace(sizeof(struct v4l2_format),
-					      aux_space, &up_native);
+					      aux_space, &new_p64);
 		if (!err) {
-			aux_buf = up_native + sizeof(struct v4l2_format);
-			err = get_v4l2_format32(up_native, up,
+			aux_buf = new_p64 + sizeof(struct v4l2_format);
+			err = get_v4l2_format32(new_p64, p32,
 						aux_buf, aux_space);
 		}
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_CREATE_BUFS:
-		err = bufsize_v4l2_create(up, &aux_space);
+		err = bufsize_v4l2_create(p32, &aux_space);
 		if (!err)
 			err = alloc_userspace(sizeof(struct v4l2_create_buffers),
-					      aux_space, &up_native);
+					      aux_space, &new_p64);
 		if (!err) {
-			aux_buf = up_native + sizeof(struct v4l2_create_buffers);
-			err = get_v4l2_create32(up_native, up,
+			aux_buf = new_p64 + sizeof(struct v4l2_create_buffers);
+			err = get_v4l2_create32(new_p64, p32,
 						aux_buf, aux_space);
 		}
 		compatible_arg = 0;
@@ -1131,13 +1131,13 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 	case VIDIOC_QUERYBUF:
 	case VIDIOC_QBUF:
 	case VIDIOC_DQBUF:
-		err = bufsize_v4l2_buffer(up, &aux_space);
+		err = bufsize_v4l2_buffer(p32, &aux_space);
 		if (!err)
 			err = alloc_userspace(sizeof(struct v4l2_buffer),
-					      aux_space, &up_native);
+					      aux_space, &new_p64);
 		if (!err) {
-			aux_buf = up_native + sizeof(struct v4l2_buffer);
-			err = get_v4l2_buffer32(up_native, up,
+			aux_buf = new_p64 + sizeof(struct v4l2_buffer);
+			err = get_v4l2_buffer32(new_p64, p32,
 						aux_buf, aux_space);
 		}
 		compatible_arg = 0;
@@ -1145,49 +1145,49 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 
 	case VIDIOC_S_FBUF:
 		err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0,
-				      &up_native);
+				      &new_p64);
 		if (!err)
-			err = get_v4l2_framebuffer32(up_native, up);
+			err = get_v4l2_framebuffer32(new_p64, p32);
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_G_FBUF:
 		err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0,
-				      &up_native);
+				      &new_p64);
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_ENUMSTD:
 		err = alloc_userspace(sizeof(struct v4l2_standard), 0,
-				      &up_native);
+				      &new_p64);
 		if (!err)
-			err = get_v4l2_standard32(up_native, up);
+			err = get_v4l2_standard32(new_p64, p32);
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_ENUMINPUT:
-		err = alloc_userspace(sizeof(struct v4l2_input), 0, &up_native);
+		err = alloc_userspace(sizeof(struct v4l2_input), 0, &new_p64);
 		if (!err)
-			err = get_v4l2_input32(up_native, up);
+			err = get_v4l2_input32(new_p64, p32);
 		compatible_arg = 0;
 		break;
 
 	case VIDIOC_G_EXT_CTRLS:
 	case VIDIOC_S_EXT_CTRLS:
 	case VIDIOC_TRY_EXT_CTRLS:
-		err = bufsize_v4l2_ext_controls(up, &aux_space);
+		err = bufsize_v4l2_ext_controls(p32, &aux_space);
 		if (!err)
 			err = alloc_userspace(sizeof(struct v4l2_ext_controls),
-					      aux_space, &up_native);
+					      aux_space, &new_p64);
 		if (!err) {
-			aux_buf = up_native + sizeof(struct v4l2_ext_controls);
-			err = get_v4l2_ext_controls32(file, up_native, up,
+			aux_buf = new_p64 + sizeof(struct v4l2_ext_controls);
+			err = get_v4l2_ext_controls32(file, new_p64, p32,
 						      aux_buf, aux_space);
 		}
 		compatible_arg = 0;
 		break;
 	case VIDIOC_DQEVENT:
-		err = alloc_userspace(sizeof(struct v4l2_event), 0, &up_native);
+		err = alloc_userspace(sizeof(struct v4l2_event), 0, &new_p64);
 		compatible_arg = 0;
 		break;
 	}
@@ -1195,9 +1195,9 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 		return err;
 
 	if (compatible_arg)
-		err = native_ioctl(file, cmd, (unsigned long)up);
+		err = native_ioctl(file, cmd, (unsigned long)p32);
 	else
-		err = native_ioctl(file, cmd, (unsigned long)up_native);
+		err = native_ioctl(file, cmd, (unsigned long)new_p64);
 
 	if (err == -ENOTTY)
 		return err;
@@ -1211,11 +1211,11 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 	case VIDIOC_G_EXT_CTRLS:
 	case VIDIOC_S_EXT_CTRLS:
 	case VIDIOC_TRY_EXT_CTRLS:
-		if (put_v4l2_ext_controls32(file, up_native, up))
+		if (put_v4l2_ext_controls32(file, new_p64, p32))
 			err = -EFAULT;
 		break;
 	case VIDIOC_S_EDID:
-		if (put_v4l2_edid32(up_native, up))
+		if (put_v4l2_edid32(new_p64, p32))
 			err = -EFAULT;
 		break;
 	}
@@ -1227,46 +1227,46 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
 	case VIDIOC_S_OUTPUT:
 	case VIDIOC_G_INPUT:
 	case VIDIOC_G_OUTPUT:
-		if (assign_in_user((compat_uint_t __user *)up,
-				   ((unsigned int __user *)up_native)))
+		if (assign_in_user((compat_uint_t __user *)p32,
+				   ((unsigned int __user *)new_p64)))
 			err = -EFAULT;
 		break;
 
 	case VIDIOC_G_FBUF:
-		err = put_v4l2_framebuffer32(up_native, up);
+		err = put_v4l2_framebuffer32(new_p64, p32);
 		break;
 
 	case VIDIOC_DQEVENT:
-		err = put_v4l2_event32(up_native, up);
+		err = put_v4l2_event32(new_p64, p32);
 		break;
 
 	case VIDIOC_G_EDID:
-		err = put_v4l2_edid32(up_native, up);
+		err = put_v4l2_edid32(new_p64, p32);
 		break;
 
 	case VIDIOC_G_FMT:
 	case VIDIOC_S_FMT:
 	case VIDIOC_TRY_FMT:
-		err = put_v4l2_format32(up_native, up);
+		err = put_v4l2_format32(new_p64, p32);
 		break;
 
 	case VIDIOC_CREATE_BUFS:
-		err = put_v4l2_create32(up_native, up);
+		err = put_v4l2_create32(new_p64, p32);
 		break;
 
 	case VIDIOC_PREPARE_BUF:
 	case VIDIOC_QUERYBUF:
 	case VIDIOC_QBUF:
 	case VIDIOC_DQBUF:
-		err = put_v4l2_buffer32(up_native, up);
+		err = put_v4l2_buffer32(new_p64, p32);
 		break;
 
 	case VIDIOC_ENUMSTD:
-		err = put_v4l2_standard32(up_native, up);
+		err = put_v4l2_standard32(new_p64, p32);
 		break;
 
 	case VIDIOC_ENUMINPUT:
-		err = put_v4l2_input32(up_native, up);
+		err = put_v4l2_input32(new_p64, p32);
 		break;
 	}
 	return err;
-- 
2.14.3

Re: [PATCH 0/5] Remaining COMPILE_TEST and smatch cleanups

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 06:20:10 -0400
Mauro Carvalho Chehab <mchehab@s-opensource.com> escreveu:

> There were several interactions at the COMPILE_TEST and smatch
> patch series. While I applied most of them, there are 5 patches that
> I kept out of it. The omap3 patch that were in my tree was the old
> one. So, I'm re-posting it.
> 
> The ioctl32 patches are the latest version. Let's repost it to get some
> acks, as this patch touches at V4L2 core, so a careful review is
> always a good idea.

Forgot to mention. If anyone wants to test, the patches are at:
	https://git.linuxtv.org/mchehab/experimental.git/log/?h=compile_test_v6b

> 
> Arnd Bergmann (1):
>   media: omap3isp: allow it to build with COMPILE_TEST
> 
> Laurent Pinchart (1):
>   media: omap3isp: Enable driver compilation on ARM with COMPILE_TEST
> 
> Mauro Carvalho Chehab (3):
>   omap: omap-iommu.h: allow building drivers with COMPILE_TEST
>   media: v4l2-compat-ioctl32: fix several __user annotations
>   media: v4l2-compat-ioctl32: better name userspace pointers
> 
>  drivers/media/platform/Kconfig                |   7 +-
>  drivers/media/platform/omap3isp/isp.c         |   8 +
>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 623 +++++++++++++-------------
>  include/linux/omap-iommu.h                    |   5 +
>  4 files changed, 338 insertions(+), 305 deletions(-)
> 



Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Hans Verkuil]

On 04/17/18 12:20, Mauro Carvalho Chehab wrote:
> Smatch report several issues with bad __user annotations:
> 
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid
> 
> Fix them.
> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> ---
>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
>  1 file changed, 35 insertions(+), 16 deletions(-)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index d03a44d89649..c951ac3faf46 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
>  			return -EFAULT;
>  		break;
>  	case V4L2_MEMORY_USERPTR:
> -		if (get_user(p, &up->m.userptr) ||
> -		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
> +		if (get_user(p, &up->m.userptr)||
> +		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
>  			     &up32->m.userptr))
>  			return -EFAULT;
>  		break;
> @@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  	u32 length;
>  	enum v4l2_memory memory;
>  	struct v4l2_plane32 __user *uplane32;
> -	struct v4l2_plane __user *uplane;
> +	struct v4l2_plane *uplane;
>  	compat_caddr_t p;
>  	int ret;
>  
> @@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  
>  		if (num_planes == 0)
>  			return 0;
> -
> -		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
> +		/* We need to define uplane without __user, even though
> +		 * it does point to data in userspace here. The reason is
> +		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
> +		 * so its definition in videodev2.h doesn't have a
> +		 * __user markup. Defining uplane with __user causes
> +		 * smatch warnings, so instead declare it without __user
> +		 * and cast it as a userspace pointer to put_v4l2_plane32().
> +		 */
> +		if (get_user(uplane, &kp->m.planes))
>  			return -EFAULT;
>  		if (get_user(p, &up->m.planes))
>  			return -EFAULT;
>  		uplane32 = compat_ptr(p);
>  
>  		while (num_planes--) {
> -			ret = put_v4l2_plane32(uplane, uplane32, memory);
> +			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
>  			if (ret)
>  				return ret;
>  			++uplane;
> @@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
>  
>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
>  	    get_user(tmp, &up->base) ||
> -	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
> +	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
>  	    assign_in_user(&kp->capability, &up->capability) ||
>  	    assign_in_user(&kp->flags, &up->flags) ||
>  	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
> @@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
>  
>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
>  	    get_user(base, &kp->base) ||
> -	    put_user(ptr_to_compat(base), &up->base) ||
> +	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
>  	    assign_in_user(&up->capability, &kp->capability) ||
>  	    assign_in_user(&up->flags, &kp->flags) ||
>  	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
> @@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
>  				   struct v4l2_ext_controls32 __user *up)
>  {
>  	struct v4l2_ext_control32 __user *ucontrols;
> -	struct v4l2_ext_control __user *kcontrols;
> +	struct v4l2_ext_control *kcontrols;
>  	u32 count;
>  	u32 n;
>  	compat_caddr_t p;
>  
> +	/*
> +	 * We need to define kcontrols without __user, even though it does
> +	 * point to data in userspace here. The reason is that v4l2-ioctl.c
> +	 * copies it from userspace to kernelspace, so its definition in
> +	 * videodev2.h doesn't have a __user markup. Defining kcontrols
> +	 * with __user causes smatch warnings, so instead declare it
> +	 * without __user and cast it as a userspace pointer where needed.
> +	 */
>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
>  	    assign_in_user(&up->which, &kp->which) ||
>  	    get_user(count, &kp->count) ||
> @@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
>  		unsigned int size = sizeof(*ucontrols);
>  		u32 id;
>  
> -		if (get_user(id, &kcontrols->id) ||
> +		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||

Why use 'unsigned int' instead of u32? It's defined as __u32 in the header,
so let's keep this consistent.

>  		    put_user(id, &ucontrols->id) ||
> -		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
> -		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
> +		    assign_in_user(&ucontrols->size,
> +				   (unsigned int __user *)&kcontrols->size) ||

Same here.

> +		    copy_in_user(&ucontrols->reserved2,
> +				 (unsigned int __user *)&kcontrols->reserved2,

This can be a void __user *.

>  				 sizeof(ucontrols->reserved2)))
>  			return -EFAULT;
>  
> @@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
>  		if (ctrl_is_pointer(file, id))
>  			size -= sizeof(ucontrols->value64);
>  
> -		if (copy_in_user(ucontrols, kcontrols, size))
> +		if (copy_in_user(ucontrols,
> +			         (unsigned int __user *)kcontrols, size))

void __user *

>  			return -EFAULT;
>  
>  		ucontrols++;
> @@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
>  	    assign_in_user(&kp->pad, &up->pad) ||
>  	    assign_in_user(&kp->start_block, &up->start_block) ||
> -	    assign_in_user(&kp->blocks, &up->blocks) ||
> +	    assign_in_user(&kp->blocks,
> +			   (unsigned char __user *)&up->blocks) ||

->blocks is a u32, so this should be a u32 cast as well.

>  	    get_user(tmp, &up->edid) ||
> -	    put_user(compat_ptr(tmp), &kp->edid) ||
> +	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
>  	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
>  		return -EFAULT;
>  	return 0;
> @@ -970,7 +989,7 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
>  	    assign_in_user(&up->start_block, &kp->start_block) ||
>  	    assign_in_user(&up->blocks, &kp->blocks) ||
>  	    get_user(edid, &kp->edid) ||
> -	    put_user(ptr_to_compat(edid), &up->edid) ||
> +	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
>  	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
>  		return -EFAULT;
>  	return 0;
> 

Regards,

	Hans

Re: [PATCH 5/5] media: v4l2-compat-ioctl32: better name userspace pointers

[Hans Verkuil]

On 04/17/18 12:20, Mauro Carvalho Chehab wrote:
> In the past, "up" were an acronym for "user pointer" and "kp" for
> "kernel pointer". However, since a1dfb4c48cc1 ("media:
> v4l2-compat-ioctl32.c: refactor compat ioctl32 logic"), both
> are now __user pointers.
> 
> So, the usage of "kp" is really misleading there. So, rename
> both to just "p32" and "p64" everywhere it occurs, in order to
> make peace with this file's namespace.
> 
> There are two exceptions to "up/kp" nomenclature: at
> alloc_userspace() and at do_video_ioctl().
> 
> There, a new userspace pointer were allocated, in order to store
> the 64 bits version of the ioctl. Those were called as "up_native",
> with is, IMHO, an even worse name, as "native" could mislead of
> being the arguments that were filled from userspace. I almost
> renamed it to just "p64", but, after thinking more about that,
> it sounded better to call it as "new_p64", as this makes clearer
> that this is the data structure that was allocated inside this
> file in order to be used to pass/retrieve data when calling the
> 64-bit ready file->f_op->unlocked_ioctl() function.

Looks good to me, thanks for doing this!

Regards,

	Hans

> 
> Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> Suggested-by: Hans Verkuil <hverkuil@xs4all.nl>
> Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> ---
>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 588 +++++++++++++-------------
>  1 file changed, 294 insertions(+), 294 deletions(-)
> 
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index c951ac3faf46..8c05dd9660d3 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -56,8 +56,8 @@ struct v4l2_window32 {
>  	__u8                    global_alpha;
>  };
>  
> -static int get_v4l2_window32(struct v4l2_window __user *kp,
> -			     struct v4l2_window32 __user *up,
> +static int get_v4l2_window32(struct v4l2_window __user *p64,
> +			     struct v4l2_window32 __user *p32,
>  			     void __user *aux_buf, u32 aux_space)
>  {
>  	struct v4l2_clip32 __user *uclips;
> @@ -65,26 +65,26 @@ static int get_v4l2_window32(struct v4l2_window __user *kp,
>  	compat_caddr_t p;
>  	u32 clipcount;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    copy_in_user(&kp->w, &up->w, sizeof(up->w)) ||
> -	    assign_in_user(&kp->field, &up->field) ||
> -	    assign_in_user(&kp->chromakey, &up->chromakey) ||
> -	    assign_in_user(&kp->global_alpha, &up->global_alpha) ||
> -	    get_user(clipcount, &up->clipcount) ||
> -	    put_user(clipcount, &kp->clipcount))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    copy_in_user(&p64->w, &p32->w, sizeof(p32->w)) ||
> +	    assign_in_user(&p64->field, &p32->field) ||
> +	    assign_in_user(&p64->chromakey, &p32->chromakey) ||
> +	    assign_in_user(&p64->global_alpha, &p32->global_alpha) ||
> +	    get_user(clipcount, &p32->clipcount) ||
> +	    put_user(clipcount, &p64->clipcount))
>  		return -EFAULT;
>  	if (clipcount > 2048)
>  		return -EINVAL;
>  	if (!clipcount)
> -		return put_user(NULL, &kp->clips);
> +		return put_user(NULL, &p64->clips);
>  
> -	if (get_user(p, &up->clips))
> +	if (get_user(p, &p32->clips))
>  		return -EFAULT;
>  	uclips = compat_ptr(p);
>  	if (aux_space < clipcount * sizeof(*kclips))
>  		return -EFAULT;
>  	kclips = aux_buf;
> -	if (put_user(kclips, &kp->clips))
> +	if (put_user(kclips, &p64->clips))
>  		return -EFAULT;
>  
>  	while (clipcount--) {
> @@ -98,27 +98,27 @@ static int get_v4l2_window32(struct v4l2_window __user *kp,
>  	return 0;
>  }
>  
> -static int put_v4l2_window32(struct v4l2_window __user *kp,
> -			     struct v4l2_window32 __user *up)
> +static int put_v4l2_window32(struct v4l2_window __user *p64,
> +			     struct v4l2_window32 __user *p32)
>  {
>  	struct v4l2_clip __user *kclips;
>  	struct v4l2_clip32 __user *uclips;
>  	compat_caddr_t p;
>  	u32 clipcount;
>  
> -	if (copy_in_user(&up->w, &kp->w, sizeof(kp->w)) ||
> -	    assign_in_user(&up->field, &kp->field) ||
> -	    assign_in_user(&up->chromakey, &kp->chromakey) ||
> -	    assign_in_user(&up->global_alpha, &kp->global_alpha) ||
> -	    get_user(clipcount, &kp->clipcount) ||
> -	    put_user(clipcount, &up->clipcount))
> +	if (copy_in_user(&p32->w, &p64->w, sizeof(p64->w)) ||
> +	    assign_in_user(&p32->field, &p64->field) ||
> +	    assign_in_user(&p32->chromakey, &p64->chromakey) ||
> +	    assign_in_user(&p32->global_alpha, &p64->global_alpha) ||
> +	    get_user(clipcount, &p64->clipcount) ||
> +	    put_user(clipcount, &p32->clipcount))
>  		return -EFAULT;
>  	if (!clipcount)
>  		return 0;
>  
> -	if (get_user(kclips, &kp->clips))
> +	if (get_user(kclips, &p64->clips))
>  		return -EFAULT;
> -	if (get_user(p, &up->clips))
> +	if (get_user(p, &p32->clips))
>  		return -EFAULT;
>  	uclips = compat_ptr(p);
>  	while (clipcount--) {
> @@ -161,11 +161,11 @@ struct v4l2_create_buffers32 {
>  	__u32			reserved[8];
>  };
>  
> -static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
> +static int __bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
>  {
>  	u32 type;
>  
> -	if (get_user(type, &up->type))
> +	if (get_user(type, &p32->type))
>  		return -EFAULT;
>  
>  	switch (type) {
> @@ -173,7 +173,7 @@ static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: {
>  		u32 clipcount;
>  
> -		if (get_user(clipcount, &up->fmt.win.clipcount))
> +		if (get_user(clipcount, &p32->fmt.win.clipcount))
>  			return -EFAULT;
>  		if (clipcount > 2048)
>  			return -EINVAL;
> @@ -186,141 +186,141 @@ static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
>  	}
>  }
>  
> -static int bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size)
> +static int bufsize_v4l2_format(struct v4l2_format32 __user *p32, u32 *size)
>  {
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)))
>  		return -EFAULT;
> -	return __bufsize_v4l2_format(up, size);
> +	return __bufsize_v4l2_format(p32, size);
>  }
>  
> -static int __get_v4l2_format32(struct v4l2_format __user *kp,
> -			       struct v4l2_format32 __user *up,
> +static int __get_v4l2_format32(struct v4l2_format __user *p64,
> +			       struct v4l2_format32 __user *p32,
>  			       void __user *aux_buf, u32 aux_space)
>  {
>  	u32 type;
>  
> -	if (get_user(type, &up->type) || put_user(type, &kp->type))
> +	if (get_user(type, &p32->type) || put_user(type, &p64->type))
>  		return -EFAULT;
>  
>  	switch (type) {
>  	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
> -		return copy_in_user(&kp->fmt.pix, &up->fmt.pix,
> -				    sizeof(kp->fmt.pix)) ? -EFAULT : 0;
> +		return copy_in_user(&p64->fmt.pix, &p32->fmt.pix,
> +				    sizeof(p64->fmt.pix)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
> -		return copy_in_user(&kp->fmt.pix_mp, &up->fmt.pix_mp,
> -				    sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0;
> +		return copy_in_user(&p64->fmt.pix_mp, &p32->fmt.pix_mp,
> +				    sizeof(p64->fmt.pix_mp)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_VIDEO_OVERLAY:
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
> -		return get_v4l2_window32(&kp->fmt.win, &up->fmt.win,
> +		return get_v4l2_window32(&p64->fmt.win, &p32->fmt.win,
>  					 aux_buf, aux_space);
>  	case V4L2_BUF_TYPE_VBI_CAPTURE:
>  	case V4L2_BUF_TYPE_VBI_OUTPUT:
> -		return copy_in_user(&kp->fmt.vbi, &up->fmt.vbi,
> -				    sizeof(kp->fmt.vbi)) ? -EFAULT : 0;
> +		return copy_in_user(&p64->fmt.vbi, &p32->fmt.vbi,
> +				    sizeof(p64->fmt.vbi)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
>  	case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
> -		return copy_in_user(&kp->fmt.sliced, &up->fmt.sliced,
> -				    sizeof(kp->fmt.sliced)) ? -EFAULT : 0;
> +		return copy_in_user(&p64->fmt.sliced, &p32->fmt.sliced,
> +				    sizeof(p64->fmt.sliced)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_SDR_CAPTURE:
>  	case V4L2_BUF_TYPE_SDR_OUTPUT:
> -		return copy_in_user(&kp->fmt.sdr, &up->fmt.sdr,
> -				    sizeof(kp->fmt.sdr)) ? -EFAULT : 0;
> +		return copy_in_user(&p64->fmt.sdr, &p32->fmt.sdr,
> +				    sizeof(p64->fmt.sdr)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_META_CAPTURE:
> -		return copy_in_user(&kp->fmt.meta, &up->fmt.meta,
> -				    sizeof(kp->fmt.meta)) ? -EFAULT : 0;
> +		return copy_in_user(&p64->fmt.meta, &p32->fmt.meta,
> +				    sizeof(p64->fmt.meta)) ? -EFAULT : 0;
>  	default:
>  		return -EINVAL;
>  	}
>  }
>  
> -static int get_v4l2_format32(struct v4l2_format __user *kp,
> -			     struct v4l2_format32 __user *up,
> +static int get_v4l2_format32(struct v4l2_format __user *p64,
> +			     struct v4l2_format32 __user *p32,
>  			     void __user *aux_buf, u32 aux_space)
>  {
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)))
>  		return -EFAULT;
> -	return __get_v4l2_format32(kp, up, aux_buf, aux_space);
> +	return __get_v4l2_format32(p64, p32, aux_buf, aux_space);
>  }
>  
> -static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *up,
> +static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *p32,
>  			       u32 *size)
>  {
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)))
>  		return -EFAULT;
> -	return __bufsize_v4l2_format(&up->format, size);
> +	return __bufsize_v4l2_format(&p32->format, size);
>  }
>  
> -static int get_v4l2_create32(struct v4l2_create_buffers __user *kp,
> -			     struct v4l2_create_buffers32 __user *up,
> +static int get_v4l2_create32(struct v4l2_create_buffers __user *p64,
> +			     struct v4l2_create_buffers32 __user *p32,
>  			     void __user *aux_buf, u32 aux_space)
>  {
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    copy_in_user(kp, up,
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    copy_in_user(p64, p32,
>  			 offsetof(struct v4l2_create_buffers32, format)))
>  		return -EFAULT;
> -	return __get_v4l2_format32(&kp->format, &up->format,
> +	return __get_v4l2_format32(&p64->format, &p32->format,
>  				   aux_buf, aux_space);
>  }
>  
> -static int __put_v4l2_format32(struct v4l2_format __user *kp,
> -			       struct v4l2_format32 __user *up)
> +static int __put_v4l2_format32(struct v4l2_format __user *p64,
> +			       struct v4l2_format32 __user *p32)
>  {
>  	u32 type;
>  
> -	if (get_user(type, &kp->type))
> +	if (get_user(type, &p64->type))
>  		return -EFAULT;
>  
>  	switch (type) {
>  	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
> -		return copy_in_user(&up->fmt.pix, &kp->fmt.pix,
> -				    sizeof(kp->fmt.pix)) ? -EFAULT : 0;
> +		return copy_in_user(&p32->fmt.pix, &p64->fmt.pix,
> +				    sizeof(p64->fmt.pix)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
> -		return copy_in_user(&up->fmt.pix_mp, &kp->fmt.pix_mp,
> -				    sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0;
> +		return copy_in_user(&p32->fmt.pix_mp, &p64->fmt.pix_mp,
> +				    sizeof(p64->fmt.pix_mp)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_VIDEO_OVERLAY:
>  	case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
> -		return put_v4l2_window32(&kp->fmt.win, &up->fmt.win);
> +		return put_v4l2_window32(&p64->fmt.win, &p32->fmt.win);
>  	case V4L2_BUF_TYPE_VBI_CAPTURE:
>  	case V4L2_BUF_TYPE_VBI_OUTPUT:
> -		return copy_in_user(&up->fmt.vbi, &kp->fmt.vbi,
> -				    sizeof(kp->fmt.vbi)) ? -EFAULT : 0;
> +		return copy_in_user(&p32->fmt.vbi, &p64->fmt.vbi,
> +				    sizeof(p64->fmt.vbi)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
>  	case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
> -		return copy_in_user(&up->fmt.sliced, &kp->fmt.sliced,
> -				    sizeof(kp->fmt.sliced)) ? -EFAULT : 0;
> +		return copy_in_user(&p32->fmt.sliced, &p64->fmt.sliced,
> +				    sizeof(p64->fmt.sliced)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_SDR_CAPTURE:
>  	case V4L2_BUF_TYPE_SDR_OUTPUT:
> -		return copy_in_user(&up->fmt.sdr, &kp->fmt.sdr,
> -				    sizeof(kp->fmt.sdr)) ? -EFAULT : 0;
> +		return copy_in_user(&p32->fmt.sdr, &p64->fmt.sdr,
> +				    sizeof(p64->fmt.sdr)) ? -EFAULT : 0;
>  	case V4L2_BUF_TYPE_META_CAPTURE:
> -		return copy_in_user(&up->fmt.meta, &kp->fmt.meta,
> -				    sizeof(kp->fmt.meta)) ? -EFAULT : 0;
> +		return copy_in_user(&p32->fmt.meta, &p64->fmt.meta,
> +				    sizeof(p64->fmt.meta)) ? -EFAULT : 0;
>  	default:
>  		return -EINVAL;
>  	}
>  }
>  
> -static int put_v4l2_format32(struct v4l2_format __user *kp,
> -			     struct v4l2_format32 __user *up)
> +static int put_v4l2_format32(struct v4l2_format __user *p64,
> +			     struct v4l2_format32 __user *p32)
>  {
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)))
>  		return -EFAULT;
> -	return __put_v4l2_format32(kp, up);
> +	return __put_v4l2_format32(p64, p32);
>  }
>  
> -static int put_v4l2_create32(struct v4l2_create_buffers __user *kp,
> -			     struct v4l2_create_buffers32 __user *up)
> +static int put_v4l2_create32(struct v4l2_create_buffers __user *p64,
> +			     struct v4l2_create_buffers32 __user *p32)
>  {
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    copy_in_user(up, kp,
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    copy_in_user(p32, p64,
>  			 offsetof(struct v4l2_create_buffers32, format)) ||
> -	    copy_in_user(up->reserved, kp->reserved, sizeof(kp->reserved)))
> +	    copy_in_user(p32->reserved, p64->reserved, sizeof(p64->reserved)))
>  		return -EFAULT;
> -	return __put_v4l2_format32(&kp->format, &up->format);
> +	return __put_v4l2_format32(&p64->format, &p32->format);
>  }
>  
>  struct v4l2_standard32 {
> @@ -332,27 +332,27 @@ struct v4l2_standard32 {
>  	__u32		     reserved[4];
>  };
>  
> -static int get_v4l2_standard32(struct v4l2_standard __user *kp,
> -			       struct v4l2_standard32 __user *up)
> +static int get_v4l2_standard32(struct v4l2_standard __user *p64,
> +			       struct v4l2_standard32 __user *p32)
>  {
>  	/* other fields are not set by the user, nor used by the driver */
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    assign_in_user(&kp->index, &up->index))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p64->index, &p32->index))
>  		return -EFAULT;
>  	return 0;
>  }
>  
> -static int put_v4l2_standard32(struct v4l2_standard __user *kp,
> -			       struct v4l2_standard32 __user *up)
> +static int put_v4l2_standard32(struct v4l2_standard __user *p64,
> +			       struct v4l2_standard32 __user *p32)
>  {
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    assign_in_user(&up->index, &kp->index) ||
> -	    assign_in_user(&up->id, &kp->id) ||
> -	    copy_in_user(up->name, kp->name, sizeof(up->name)) ||
> -	    copy_in_user(&up->frameperiod, &kp->frameperiod,
> -			 sizeof(up->frameperiod)) ||
> -	    assign_in_user(&up->framelines, &kp->framelines) ||
> -	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p32->index, &p64->index) ||
> +	    assign_in_user(&p32->id, &p64->id) ||
> +	    copy_in_user(p32->name, p64->name, sizeof(p32->name)) ||
> +	    copy_in_user(&p32->frameperiod, &p64->frameperiod,
> +			 sizeof(p32->frameperiod)) ||
> +	    assign_in_user(&p32->framelines, &p64->framelines) ||
> +	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)))
>  		return -EFAULT;
>  	return 0;
>  }
> @@ -392,31 +392,31 @@ struct v4l2_buffer32 {
>  	__u32			reserved;
>  };
>  
> -static int get_v4l2_plane32(struct v4l2_plane __user *up,
> -			    struct v4l2_plane32 __user *up32,
> +static int get_v4l2_plane32(struct v4l2_plane __user *p64,
> +			    struct v4l2_plane32 __user *p32,
>  			    enum v4l2_memory memory)
>  {
>  	compat_ulong_t p;
>  
> -	if (copy_in_user(up, up32, 2 * sizeof(__u32)) ||
> -	    copy_in_user(&up->data_offset, &up32->data_offset,
> -			 sizeof(up->data_offset)))
> +	if (copy_in_user(p64, p32, 2 * sizeof(__u32)) ||
> +	    copy_in_user(&p64->data_offset, &p32->data_offset,
> +			 sizeof(p64->data_offset)))
>  		return -EFAULT;
>  
>  	switch (memory) {
>  	case V4L2_MEMORY_MMAP:
>  	case V4L2_MEMORY_OVERLAY:
> -		if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
> -				 sizeof(up32->m.mem_offset)))
> +		if (copy_in_user(&p64->m.mem_offset, &p32->m.mem_offset,
> +				 sizeof(p32->m.mem_offset)))
>  			return -EFAULT;
>  		break;
>  	case V4L2_MEMORY_USERPTR:
> -		if (get_user(p, &up32->m.userptr) ||
> -		    put_user((unsigned long)compat_ptr(p), &up->m.userptr))
> +		if (get_user(p, &p32->m.userptr) ||
> +		    put_user((unsigned long)compat_ptr(p), &p64->m.userptr))
>  			return -EFAULT;
>  		break;
>  	case V4L2_MEMORY_DMABUF:
> -		if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd)))
> +		if (copy_in_user(&p64->m.fd, &p32->m.fd, sizeof(p32->m.fd)))
>  			return -EFAULT;
>  		break;
>  	}
> @@ -424,32 +424,32 @@ static int get_v4l2_plane32(struct v4l2_plane __user *up,
>  	return 0;
>  }
>  
> -static int put_v4l2_plane32(struct v4l2_plane __user *up,
> -			    struct v4l2_plane32 __user *up32,
> +static int put_v4l2_plane32(struct v4l2_plane __user *p64,
> +			    struct v4l2_plane32 __user *p32,
>  			    enum v4l2_memory memory)
>  {
>  	unsigned long p;
>  
> -	if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
> -	    copy_in_user(&up32->data_offset, &up->data_offset,
> -			 sizeof(up->data_offset)))
> +	if (copy_in_user(p32, p64, 2 * sizeof(__u32)) ||
> +	    copy_in_user(&p32->data_offset, &p64->data_offset,
> +			 sizeof(p64->data_offset)))
>  		return -EFAULT;
>  
>  	switch (memory) {
>  	case V4L2_MEMORY_MMAP:
>  	case V4L2_MEMORY_OVERLAY:
> -		if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
> -				 sizeof(up->m.mem_offset)))
> +		if (copy_in_user(&p32->m.mem_offset, &p64->m.mem_offset,
> +				 sizeof(p64->m.mem_offset)))
>  			return -EFAULT;
>  		break;
>  	case V4L2_MEMORY_USERPTR:
> -		if (get_user(p, &up->m.userptr)||
> +		if (get_user(p, &p64->m.userptr)||
>  		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
> -			     &up32->m.userptr))
> +			     &p32->m.userptr))
>  			return -EFAULT;
>  		break;
>  	case V4L2_MEMORY_DMABUF:
> -		if (copy_in_user(&up32->m.fd, &up->m.fd, sizeof(up->m.fd)))
> +		if (copy_in_user(&p32->m.fd, &p64->m.fd, sizeof(p64->m.fd)))
>  			return -EFAULT;
>  		break;
>  	}
> @@ -457,14 +457,14 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
>  	return 0;
>  }
>  
> -static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *up, u32 *size)
> +static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *p32, u32 *size)
>  {
>  	u32 type;
>  	u32 length;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    get_user(type, &up->type) ||
> -	    get_user(length, &up->length))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    get_user(type, &p32->type) ||
> +	    get_user(length, &p32->length))
>  		return -EFAULT;
>  
>  	if (V4L2_TYPE_IS_MULTIPLANAR(type)) {
> @@ -482,8 +482,8 @@ static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *up, u32 *size)
>  	return 0;
>  }
>  
> -static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
> -			     struct v4l2_buffer32 __user *up,
> +static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
> +			     struct v4l2_buffer32 __user *p32,
>  			     void __user *aux_buf, u32 aux_space)
>  {
>  	u32 type;
> @@ -494,24 +494,24 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  	compat_caddr_t p;
>  	int ret;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    assign_in_user(&kp->index, &up->index) ||
> -	    get_user(type, &up->type) ||
> -	    put_user(type, &kp->type) ||
> -	    assign_in_user(&kp->flags, &up->flags) ||
> -	    get_user(memory, &up->memory) ||
> -	    put_user(memory, &kp->memory) ||
> -	    get_user(length, &up->length) ||
> -	    put_user(length, &kp->length))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p64->index, &p32->index) ||
> +	    get_user(type, &p32->type) ||
> +	    put_user(type, &p64->type) ||
> +	    assign_in_user(&p64->flags, &p32->flags) ||
> +	    get_user(memory, &p32->memory) ||
> +	    put_user(memory, &p64->memory) ||
> +	    get_user(length, &p32->length) ||
> +	    put_user(length, &p64->length))
>  		return -EFAULT;
>  
>  	if (V4L2_TYPE_IS_OUTPUT(type))
> -		if (assign_in_user(&kp->bytesused, &up->bytesused) ||
> -		    assign_in_user(&kp->field, &up->field) ||
> -		    assign_in_user(&kp->timestamp.tv_sec,
> -				   &up->timestamp.tv_sec) ||
> -		    assign_in_user(&kp->timestamp.tv_usec,
> -				   &up->timestamp.tv_usec))
> +		if (assign_in_user(&p64->bytesused, &p32->bytesused) ||
> +		    assign_in_user(&p64->field, &p32->field) ||
> +		    assign_in_user(&p64->timestamp.tv_sec,
> +				   &p32->timestamp.tv_sec) ||
> +		    assign_in_user(&p64->timestamp.tv_usec,
> +				   &p32->timestamp.tv_usec))
>  			return -EFAULT;
>  
>  	if (V4L2_TYPE_IS_MULTIPLANAR(type)) {
> @@ -522,12 +522,12 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  			 * num_planes == 0 is legal, e.g. when userspace doesn't
>  			 * need planes array on DQBUF
>  			 */
> -			return put_user(NULL, &kp->m.planes);
> +			return put_user(NULL, &p64->m.planes);
>  		}
>  		if (num_planes > VIDEO_MAX_PLANES)
>  			return -EINVAL;
>  
> -		if (get_user(p, &up->m.planes))
> +		if (get_user(p, &p32->m.planes))
>  			return -EFAULT;
>  
>  		uplane32 = compat_ptr(p);
> @@ -544,7 +544,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  
>  		uplane = aux_buf;
>  		if (put_user((__force struct v4l2_plane *)uplane,
> -			     &kp->m.planes))
> +			     &p64->m.planes))
>  			return -EFAULT;
>  
>  		while (num_planes--) {
> @@ -558,20 +558,20 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  		switch (memory) {
>  		case V4L2_MEMORY_MMAP:
>  		case V4L2_MEMORY_OVERLAY:
> -			if (assign_in_user(&kp->m.offset, &up->m.offset))
> +			if (assign_in_user(&p64->m.offset, &p32->m.offset))
>  				return -EFAULT;
>  			break;
>  		case V4L2_MEMORY_USERPTR: {
>  			compat_ulong_t userptr;
>  
> -			if (get_user(userptr, &up->m.userptr) ||
> +			if (get_user(userptr, &p32->m.userptr) ||
>  			    put_user((unsigned long)compat_ptr(userptr),
> -				     &kp->m.userptr))
> +				     &p64->m.userptr))
>  				return -EFAULT;
>  			break;
>  		}
>  		case V4L2_MEMORY_DMABUF:
> -			if (assign_in_user(&kp->m.fd, &up->m.fd))
> +			if (assign_in_user(&p64->m.fd, &p32->m.fd))
>  				return -EFAULT;
>  			break;
>  		}
> @@ -580,8 +580,8 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  	return 0;
>  }
>  
> -static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> -			     struct v4l2_buffer32 __user *up)
> +static int put_v4l2_buffer32(struct v4l2_buffer __user *p64,
> +			     struct v4l2_buffer32 __user *p32)
>  {
>  	u32 type;
>  	u32 length;
> @@ -591,25 +591,25 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  	compat_caddr_t p;
>  	int ret;
>  
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    assign_in_user(&up->index, &kp->index) ||
> -	    get_user(type, &kp->type) ||
> -	    put_user(type, &up->type) ||
> -	    assign_in_user(&up->flags, &kp->flags) ||
> -	    get_user(memory, &kp->memory) ||
> -	    put_user(memory, &up->memory))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p32->index, &p64->index) ||
> +	    get_user(type, &p64->type) ||
> +	    put_user(type, &p32->type) ||
> +	    assign_in_user(&p32->flags, &p64->flags) ||
> +	    get_user(memory, &p64->memory) ||
> +	    put_user(memory, &p32->memory))
>  		return -EFAULT;
>  
> -	if (assign_in_user(&up->bytesused, &kp->bytesused) ||
> -	    assign_in_user(&up->field, &kp->field) ||
> -	    assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) ||
> -	    assign_in_user(&up->timestamp.tv_usec, &kp->timestamp.tv_usec) ||
> -	    copy_in_user(&up->timecode, &kp->timecode, sizeof(kp->timecode)) ||
> -	    assign_in_user(&up->sequence, &kp->sequence) ||
> -	    assign_in_user(&up->reserved2, &kp->reserved2) ||
> -	    assign_in_user(&up->reserved, &kp->reserved) ||
> -	    get_user(length, &kp->length) ||
> -	    put_user(length, &up->length))
> +	if (assign_in_user(&p32->bytesused, &p64->bytesused) ||
> +	    assign_in_user(&p32->field, &p64->field) ||
> +	    assign_in_user(&p32->timestamp.tv_sec, &p64->timestamp.tv_sec) ||
> +	    assign_in_user(&p32->timestamp.tv_usec, &p64->timestamp.tv_usec) ||
> +	    copy_in_user(&p32->timecode, &p64->timecode, sizeof(p64->timecode)) ||
> +	    assign_in_user(&p32->sequence, &p64->sequence) ||
> +	    assign_in_user(&p32->reserved2, &p64->reserved2) ||
> +	    assign_in_user(&p32->reserved, &p64->reserved) ||
> +	    get_user(length, &p64->length) ||
> +	    put_user(length, &p32->length))
>  		return -EFAULT;
>  
>  	if (V4L2_TYPE_IS_MULTIPLANAR(type)) {
> @@ -625,9 +625,9 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  		 * smatch warnings, so instead declare it without __user
>  		 * and cast it as a userspace pointer to put_v4l2_plane32().
>  		 */
> -		if (get_user(uplane, &kp->m.planes))
> +		if (get_user(uplane, &p64->m.planes))
>  			return -EFAULT;
> -		if (get_user(p, &up->m.planes))
> +		if (get_user(p, &p32->m.planes))
>  			return -EFAULT;
>  		uplane32 = compat_ptr(p);
>  
> @@ -642,15 +642,15 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>  		switch (memory) {
>  		case V4L2_MEMORY_MMAP:
>  		case V4L2_MEMORY_OVERLAY:
> -			if (assign_in_user(&up->m.offset, &kp->m.offset))
> +			if (assign_in_user(&p32->m.offset, &p64->m.offset))
>  				return -EFAULT;
>  			break;
>  		case V4L2_MEMORY_USERPTR:
> -			if (assign_in_user(&up->m.userptr, &kp->m.userptr))
> +			if (assign_in_user(&p32->m.userptr, &p64->m.userptr))
>  				return -EFAULT;
>  			break;
>  		case V4L2_MEMORY_DMABUF:
> -			if (assign_in_user(&up->m.fd, &kp->m.fd))
> +			if (assign_in_user(&p32->m.fd, &p64->m.fd))
>  				return -EFAULT;
>  			break;
>  		}
> @@ -675,32 +675,32 @@ struct v4l2_framebuffer32 {
>  	} fmt;
>  };
>  
> -static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> -				  struct v4l2_framebuffer32 __user *up)
> +static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
> +				  struct v4l2_framebuffer32 __user *p32)
>  {
>  	compat_caddr_t tmp;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    get_user(tmp, &up->base) ||
> -	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
> -	    assign_in_user(&kp->capability, &up->capability) ||
> -	    assign_in_user(&kp->flags, &up->flags) ||
> -	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    get_user(tmp, &p32->base) ||
> +	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
> +	    assign_in_user(&p64->capability, &p32->capability) ||
> +	    assign_in_user(&p64->flags, &p32->flags) ||
> +	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
>  		return -EFAULT;
>  	return 0;
>  }
>  
> -static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> -				  struct v4l2_framebuffer32 __user *up)
> +static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
> +				  struct v4l2_framebuffer32 __user *p32)
>  {
>  	void *base;
>  
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    get_user(base, &kp->base) ||
> -	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
> -	    assign_in_user(&up->capability, &kp->capability) ||
> -	    assign_in_user(&up->flags, &kp->flags) ||
> -	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    get_user(base, &p64->base) ||
> +	    put_user(ptr_to_compat((void __user *)base), &p32->base) ||
> +	    assign_in_user(&p32->capability, &p64->capability) ||
> +	    assign_in_user(&p32->flags, &p64->flags) ||
> +	    copy_in_user(&p32->fmt, &p64->fmt, sizeof(p64->fmt)))
>  		return -EFAULT;
>  	return 0;
>  }
> @@ -721,18 +721,18 @@ struct v4l2_input32 {
>   * The 64-bit v4l2_input struct has extra padding at the end of the struct.
>   * Otherwise it is identical to the 32-bit version.
>   */
> -static inline int get_v4l2_input32(struct v4l2_input __user *kp,
> -				   struct v4l2_input32 __user *up)
> +static inline int get_v4l2_input32(struct v4l2_input __user *p64,
> +				   struct v4l2_input32 __user *p32)
>  {
> -	if (copy_in_user(kp, up, sizeof(*up)))
> +	if (copy_in_user(p64, p32, sizeof(*p32)))
>  		return -EFAULT;
>  	return 0;
>  }
>  
> -static inline int put_v4l2_input32(struct v4l2_input __user *kp,
> -				   struct v4l2_input32 __user *up)
> +static inline int put_v4l2_input32(struct v4l2_input __user *p64,
> +				   struct v4l2_input32 __user *p32)
>  {
> -	if (copy_in_user(up, kp, sizeof(*up)))
> +	if (copy_in_user(p32, p64, sizeof(*p32)))
>  		return -EFAULT;
>  	return 0;
>  }
> @@ -786,13 +786,13 @@ static inline bool ctrl_is_pointer(struct file *file, u32 id)
>  		(qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD);
>  }
>  
> -static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *up,
> +static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *p32,
>  				     u32 *size)
>  {
>  	u32 count;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    get_user(count, &up->count))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    get_user(count, &p32->count))
>  		return -EFAULT;
>  	if (count > V4L2_CID_MAX_CTRLS)
>  		return -EINVAL;
> @@ -801,8 +801,8 @@ static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *up,
>  }
>  
>  static int get_v4l2_ext_controls32(struct file *file,
> -				   struct v4l2_ext_controls __user *kp,
> -				   struct v4l2_ext_controls32 __user *up,
> +				   struct v4l2_ext_controls __user *p64,
> +				   struct v4l2_ext_controls32 __user *p32,
>  				   void __user *aux_buf, u32 aux_space)
>  {
>  	struct v4l2_ext_control32 __user *ucontrols;
> @@ -811,19 +811,19 @@ static int get_v4l2_ext_controls32(struct file *file,
>  	u32 n;
>  	compat_caddr_t p;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    assign_in_user(&kp->which, &up->which) ||
> -	    get_user(count, &up->count) ||
> -	    put_user(count, &kp->count) ||
> -	    assign_in_user(&kp->error_idx, &up->error_idx) ||
> -	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p64->which, &p32->which) ||
> +	    get_user(count, &p32->count) ||
> +	    put_user(count, &p64->count) ||
> +	    assign_in_user(&p64->error_idx, &p32->error_idx) ||
> +	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
>  		return -EFAULT;
>  
>  	if (count == 0)
> -		return put_user(NULL, &kp->controls);
> +		return put_user(NULL, &p64->controls);
>  	if (count > V4L2_CID_MAX_CTRLS)
>  		return -EINVAL;
> -	if (get_user(p, &up->controls))
> +	if (get_user(p, &p32->controls))
>  		return -EFAULT;
>  	ucontrols = compat_ptr(p);
>  	if (!access_ok(VERIFY_READ, ucontrols, count * sizeof(*ucontrols)))
> @@ -832,7 +832,7 @@ static int get_v4l2_ext_controls32(struct file *file,
>  		return -EFAULT;
>  	kcontrols = aux_buf;
>  	if (put_user((__force struct v4l2_ext_control *)kcontrols,
> -		     &kp->controls))
> +		     &p64->controls))
>  		return -EFAULT;
>  
>  	for (n = 0; n < count; n++) {
> @@ -860,8 +860,8 @@ static int get_v4l2_ext_controls32(struct file *file,
>  }
>  
>  static int put_v4l2_ext_controls32(struct file *file,
> -				   struct v4l2_ext_controls __user *kp,
> -				   struct v4l2_ext_controls32 __user *up)
> +				   struct v4l2_ext_controls __user *p64,
> +				   struct v4l2_ext_controls32 __user *p32)
>  {
>  	struct v4l2_ext_control32 __user *ucontrols;
>  	struct v4l2_ext_control *kcontrols;
> @@ -877,18 +877,18 @@ static int put_v4l2_ext_controls32(struct file *file,
>  	 * with __user causes smatch warnings, so instead declare it
>  	 * without __user and cast it as a userspace pointer where needed.
>  	 */
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    assign_in_user(&up->which, &kp->which) ||
> -	    get_user(count, &kp->count) ||
> -	    put_user(count, &up->count) ||
> -	    assign_in_user(&up->error_idx, &kp->error_idx) ||
> -	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)) ||
> -	    get_user(kcontrols, &kp->controls))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p32->which, &p64->which) ||
> +	    get_user(count, &p64->count) ||
> +	    put_user(count, &p32->count) ||
> +	    assign_in_user(&p32->error_idx, &p64->error_idx) ||
> +	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)) ||
> +	    get_user(kcontrols, &p64->controls))
>  		return -EFAULT;
>  
>  	if (!count || count > (U32_MAX/sizeof(*ucontrols)))
>  		return 0;
> -	if (get_user(p, &up->controls))
> +	if (get_user(p, &p32->controls))
>  		return -EFAULT;
>  	ucontrols = compat_ptr(p);
>  	if (!access_ok(VERIFY_WRITE, ucontrols, count * sizeof(*ucontrols)))
> @@ -938,18 +938,18 @@ struct v4l2_event32 {
>  	__u32				reserved[8];
>  };
>  
> -static int put_v4l2_event32(struct v4l2_event __user *kp,
> -			    struct v4l2_event32 __user *up)
> +static int put_v4l2_event32(struct v4l2_event __user *p64,
> +			    struct v4l2_event32 __user *p32)
>  {
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    assign_in_user(&up->type, &kp->type) ||
> -	    copy_in_user(&up->u, &kp->u, sizeof(kp->u)) ||
> -	    assign_in_user(&up->pending, &kp->pending) ||
> -	    assign_in_user(&up->sequence, &kp->sequence) ||
> -	    assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) ||
> -	    assign_in_user(&up->timestamp.tv_nsec, &kp->timestamp.tv_nsec) ||
> -	    assign_in_user(&up->id, &kp->id) ||
> -	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p32->type, &p64->type) ||
> +	    copy_in_user(&p32->u, &p64->u, sizeof(p64->u)) ||
> +	    assign_in_user(&p32->pending, &p64->pending) ||
> +	    assign_in_user(&p32->sequence, &p64->sequence) ||
> +	    assign_in_user(&p32->timestamp.tv_sec, &p64->timestamp.tv_sec) ||
> +	    assign_in_user(&p32->timestamp.tv_nsec, &p64->timestamp.tv_nsec) ||
> +	    assign_in_user(&p32->id, &p64->id) ||
> +	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)))
>  		return -EFAULT;
>  	return 0;
>  }
> @@ -962,35 +962,35 @@ struct v4l2_edid32 {
>  	compat_caddr_t edid;
>  };
>  
> -static int get_v4l2_edid32(struct v4l2_edid __user *kp,
> -			   struct v4l2_edid32 __user *up)
> +static int get_v4l2_edid32(struct v4l2_edid __user *p64,
> +			   struct v4l2_edid32 __user *p32)
>  {
>  	compat_uptr_t tmp;
>  
> -	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> -	    assign_in_user(&kp->pad, &up->pad) ||
> -	    assign_in_user(&kp->start_block, &up->start_block) ||
> -	    assign_in_user(&kp->blocks,
> -			   (unsigned char __user *)&up->blocks) ||
> -	    get_user(tmp, &up->edid) ||
> -	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
> -	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
> +	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p64->pad, &p32->pad) ||
> +	    assign_in_user(&p64->start_block, &p32->start_block) ||
> +	    assign_in_user(&p64->blocks,
> +			   (unsigned char __user *)&p32->blocks) ||
> +	    get_user(tmp, &p32->edid) ||
> +	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
> +	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
>  		return -EFAULT;
>  	return 0;
>  }
>  
> -static int put_v4l2_edid32(struct v4l2_edid __user *kp,
> -			   struct v4l2_edid32 __user *up)
> +static int put_v4l2_edid32(struct v4l2_edid __user *p64,
> +			   struct v4l2_edid32 __user *p32)
>  {
>  	void *edid;
>  
> -	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> -	    assign_in_user(&up->pad, &kp->pad) ||
> -	    assign_in_user(&up->start_block, &kp->start_block) ||
> -	    assign_in_user(&up->blocks, &kp->blocks) ||
> -	    get_user(edid, &kp->edid) ||
> -	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
> -	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
> +	if (!access_ok(VERIFY_WRITE, p32, sizeof(*p32)) ||
> +	    assign_in_user(&p32->pad, &p64->pad) ||
> +	    assign_in_user(&p32->start_block, &p64->start_block) ||
> +	    assign_in_user(&p32->blocks, &p64->blocks) ||
> +	    get_user(edid, &p64->edid) ||
> +	    put_user(ptr_to_compat((void __user *)edid), &p32->edid) ||
> +	    copy_in_user(p32->reserved, p64->reserved, sizeof(p32->reserved)))
>  		return -EFAULT;
>  	return 0;
>  }
> @@ -1024,20 +1024,20 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
>  #define VIDIOC_S_OUTPUT32	_IOWR('V', 47, s32)
>  
>  static int alloc_userspace(unsigned int size, u32 aux_space,
> -			   void __user **up_native)
> +			   void __user **new_p64)
>  {
> -	*up_native = compat_alloc_user_space(size + aux_space);
> -	if (!*up_native)
> +	*new_p64 = compat_alloc_user_space(size + aux_space);
> +	if (!*new_p64)
>  		return -ENOMEM;
> -	if (clear_user(*up_native, size))
> +	if (clear_user(*new_p64, size))
>  		return -EFAULT;
>  	return 0;
>  }
>  
>  static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>  {
> -	void __user *up = compat_ptr(arg);
> -	void __user *up_native = NULL;
> +	void __user *p32 = compat_ptr(arg);
> +	void __user *new_p64 = NULL;
>  	void __user *aux_buf;
>  	u32 aux_space;
>  	int compatible_arg = 1;
> @@ -1078,50 +1078,50 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
>  	case VIDIOC_STREAMOFF:
>  	case VIDIOC_S_INPUT:
>  	case VIDIOC_S_OUTPUT:
> -		err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> -		if (!err && assign_in_user((unsigned int __user *)up_native,
> -					   (compat_uint_t __user *)up))
> +		err = alloc_userspace(sizeof(unsigned int), 0, &new_p64);
> +		if (!err && assign_in_user((unsigned int __user *)new_p64,
> +					   (compat_uint_t __user *)p32))
>  			err = -EFAULT;
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_G_INPUT:
>  	case VIDIOC_G_OUTPUT:
> -		err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> +		err = alloc_userspace(sizeof(unsigned int), 0, &new_p64);
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_G_EDID:
>  	case VIDIOC_S_EDID:
> -		err = alloc_userspace(sizeof(struct v4l2_edid), 0, &up_native);
> +		err = alloc_userspace(sizeof(struct v4l2_edid), 0, &new_p64);
>  		if (!err)
> -			err = get_v4l2_edid32(up_native, up);
> +			err = get_v4l2_edid32(new_p64, p32);
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_G_FMT:
>  	case VIDIOC_S_FMT:
>  	case VIDIOC_TRY_FMT:
> -		err = bufsize_v4l2_format(up, &aux_space);
> +		err = bufsize_v4l2_format(p32, &aux_space);
>  		if (!err)
>  			err = alloc_userspace(sizeof(struct v4l2_format),
> -					      aux_space, &up_native);
> +					      aux_space, &new_p64);
>  		if (!err) {
> -			aux_buf = up_native + sizeof(struct v4l2_format);
> -			err = get_v4l2_format32(up_native, up,
> +			aux_buf = new_p64 + sizeof(struct v4l2_format);
> +			err = get_v4l2_format32(new_p64, p32,
>  						aux_buf, aux_space);
>  		}
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_CREATE_BUFS:
> -		err = bufsize_v4l2_create(up, &aux_space);
> +		err = bufsize_v4l2_create(p32, &aux_space);
>  		if (!err)
>  			err = alloc_userspace(sizeof(struct v4l2_create_buffers),
> -					      aux_space, &up_native);
> +					      aux_space, &new_p64);
>  		if (!err) {
> -			aux_buf = up_native + sizeof(struct v4l2_create_buffers);
> -			err = get_v4l2_create32(up_native, up,
> +			aux_buf = new_p64 + sizeof(struct v4l2_create_buffers);
> +			err = get_v4l2_create32(new_p64, p32,
>  						aux_buf, aux_space);
>  		}
>  		compatible_arg = 0;
> @@ -1131,13 +1131,13 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
>  	case VIDIOC_QUERYBUF:
>  	case VIDIOC_QBUF:
>  	case VIDIOC_DQBUF:
> -		err = bufsize_v4l2_buffer(up, &aux_space);
> +		err = bufsize_v4l2_buffer(p32, &aux_space);
>  		if (!err)
>  			err = alloc_userspace(sizeof(struct v4l2_buffer),
> -					      aux_space, &up_native);
> +					      aux_space, &new_p64);
>  		if (!err) {
> -			aux_buf = up_native + sizeof(struct v4l2_buffer);
> -			err = get_v4l2_buffer32(up_native, up,
> +			aux_buf = new_p64 + sizeof(struct v4l2_buffer);
> +			err = get_v4l2_buffer32(new_p64, p32,
>  						aux_buf, aux_space);
>  		}
>  		compatible_arg = 0;
> @@ -1145,49 +1145,49 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
>  
>  	case VIDIOC_S_FBUF:
>  		err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0,
> -				      &up_native);
> +				      &new_p64);
>  		if (!err)
> -			err = get_v4l2_framebuffer32(up_native, up);
> +			err = get_v4l2_framebuffer32(new_p64, p32);
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_G_FBUF:
>  		err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0,
> -				      &up_native);
> +				      &new_p64);
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_ENUMSTD:
>  		err = alloc_userspace(sizeof(struct v4l2_standard), 0,
> -				      &up_native);
> +				      &new_p64);
>  		if (!err)
> -			err = get_v4l2_standard32(up_native, up);
> +			err = get_v4l2_standard32(new_p64, p32);
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_ENUMINPUT:
> -		err = alloc_userspace(sizeof(struct v4l2_input), 0, &up_native);
> +		err = alloc_userspace(sizeof(struct v4l2_input), 0, &new_p64);
>  		if (!err)
> -			err = get_v4l2_input32(up_native, up);
> +			err = get_v4l2_input32(new_p64, p32);
>  		compatible_arg = 0;
>  		break;
>  
>  	case VIDIOC_G_EXT_CTRLS:
>  	case VIDIOC_S_EXT_CTRLS:
>  	case VIDIOC_TRY_EXT_CTRLS:
> -		err = bufsize_v4l2_ext_controls(up, &aux_space);
> +		err = bufsize_v4l2_ext_controls(p32, &aux_space);
>  		if (!err)
>  			err = alloc_userspace(sizeof(struct v4l2_ext_controls),
> -					      aux_space, &up_native);
> +					      aux_space, &new_p64);
>  		if (!err) {
> -			aux_buf = up_native + sizeof(struct v4l2_ext_controls);
> -			err = get_v4l2_ext_controls32(file, up_native, up,
> +			aux_buf = new_p64 + sizeof(struct v4l2_ext_controls);
> +			err = get_v4l2_ext_controls32(file, new_p64, p32,
>  						      aux_buf, aux_space);
>  		}
>  		compatible_arg = 0;
>  		break;
>  	case VIDIOC_DQEVENT:
> -		err = alloc_userspace(sizeof(struct v4l2_event), 0, &up_native);
> +		err = alloc_userspace(sizeof(struct v4l2_event), 0, &new_p64);
>  		compatible_arg = 0;
>  		break;
>  	}
> @@ -1195,9 +1195,9 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
>  		return err;
>  
>  	if (compatible_arg)
> -		err = native_ioctl(file, cmd, (unsigned long)up);
> +		err = native_ioctl(file, cmd, (unsigned long)p32);
>  	else
> -		err = native_ioctl(file, cmd, (unsigned long)up_native);
> +		err = native_ioctl(file, cmd, (unsigned long)new_p64);
>  
>  	if (err == -ENOTTY)
>  		return err;
> @@ -1211,11 +1211,11 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
>  	case VIDIOC_G_EXT_CTRLS:
>  	case VIDIOC_S_EXT_CTRLS:
>  	case VIDIOC_TRY_EXT_CTRLS:
> -		if (put_v4l2_ext_controls32(file, up_native, up))
> +		if (put_v4l2_ext_controls32(file, new_p64, p32))
>  			err = -EFAULT;
>  		break;
>  	case VIDIOC_S_EDID:
> -		if (put_v4l2_edid32(up_native, up))
> +		if (put_v4l2_edid32(new_p64, p32))
>  			err = -EFAULT;
>  		break;
>  	}
> @@ -1227,46 +1227,46 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
>  	case VIDIOC_S_OUTPUT:
>  	case VIDIOC_G_INPUT:
>  	case VIDIOC_G_OUTPUT:
> -		if (assign_in_user((compat_uint_t __user *)up,
> -				   ((unsigned int __user *)up_native)))
> +		if (assign_in_user((compat_uint_t __user *)p32,
> +				   ((unsigned int __user *)new_p64)))
>  			err = -EFAULT;
>  		break;
>  
>  	case VIDIOC_G_FBUF:
> -		err = put_v4l2_framebuffer32(up_native, up);
> +		err = put_v4l2_framebuffer32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_DQEVENT:
> -		err = put_v4l2_event32(up_native, up);
> +		err = put_v4l2_event32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_G_EDID:
> -		err = put_v4l2_edid32(up_native, up);
> +		err = put_v4l2_edid32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_G_FMT:
>  	case VIDIOC_S_FMT:
>  	case VIDIOC_TRY_FMT:
> -		err = put_v4l2_format32(up_native, up);
> +		err = put_v4l2_format32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_CREATE_BUFS:
> -		err = put_v4l2_create32(up_native, up);
> +		err = put_v4l2_create32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_PREPARE_BUF:
>  	case VIDIOC_QUERYBUF:
>  	case VIDIOC_QBUF:
>  	case VIDIOC_DQBUF:
> -		err = put_v4l2_buffer32(up_native, up);
> +		err = put_v4l2_buffer32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_ENUMSTD:
> -		err = put_v4l2_standard32(up_native, up);
> +		err = put_v4l2_standard32(new_p64, p32);
>  		break;
>  
>  	case VIDIOC_ENUMINPUT:
> -		err = put_v4l2_input32(up_native, up);
> +		err = put_v4l2_input32(new_p64, p32);
>  		break;
>  	}
>  	return err;
> 

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 12:33:11 +0200
Hans Verkuil <hansverk@cisco.com> escreveu:

> On 04/17/18 12:20, Mauro Carvalho Chehab wrote:
> > Smatch report several issues with bad __user annotations:
> > 
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
> >   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid
> > 
> > Fix them.
> > 
> > Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> > ---
> >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
> >  1 file changed, 35 insertions(+), 16 deletions(-)
> > 
> > diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > index d03a44d89649..c951ac3faf46 100644
> > --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > @@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
> >  			return -EFAULT;
> >  		break;
> >  	case V4L2_MEMORY_USERPTR:
> > -		if (get_user(p, &up->m.userptr) ||
> > -		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
> > +		if (get_user(p, &up->m.userptr)||
> > +		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
> >  			     &up32->m.userptr))
> >  			return -EFAULT;
> >  		break;
> > @@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> >  	u32 length;
> >  	enum v4l2_memory memory;
> >  	struct v4l2_plane32 __user *uplane32;
> > -	struct v4l2_plane __user *uplane;
> > +	struct v4l2_plane *uplane;
> >  	compat_caddr_t p;
> >  	int ret;
> >  
> > @@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> >  
> >  		if (num_planes == 0)
> >  			return 0;
> > -
> > -		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
> > +		/* We need to define uplane without __user, even though
> > +		 * it does point to data in userspace here. The reason is
> > +		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
> > +		 * so its definition in videodev2.h doesn't have a
> > +		 * __user markup. Defining uplane with __user causes
> > +		 * smatch warnings, so instead declare it without __user
> > +		 * and cast it as a userspace pointer to put_v4l2_plane32().
> > +		 */
> > +		if (get_user(uplane, &kp->m.planes))
> >  			return -EFAULT;
> >  		if (get_user(p, &up->m.planes))
> >  			return -EFAULT;
> >  		uplane32 = compat_ptr(p);
> >  
> >  		while (num_planes--) {
> > -			ret = put_v4l2_plane32(uplane, uplane32, memory);
> > +			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
> >  			if (ret)
> >  				return ret;
> >  			++uplane;
> > @@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> >  
> >  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> >  	    get_user(tmp, &up->base) ||
> > -	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
> > +	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
> >  	    assign_in_user(&kp->capability, &up->capability) ||
> >  	    assign_in_user(&kp->flags, &up->flags) ||
> >  	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
> > @@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> >  
> >  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> >  	    get_user(base, &kp->base) ||
> > -	    put_user(ptr_to_compat(base), &up->base) ||
> > +	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
> >  	    assign_in_user(&up->capability, &kp->capability) ||
> >  	    assign_in_user(&up->flags, &kp->flags) ||
> >  	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
> > @@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
> >  				   struct v4l2_ext_controls32 __user *up)
> >  {
> >  	struct v4l2_ext_control32 __user *ucontrols;
> > -	struct v4l2_ext_control __user *kcontrols;
> > +	struct v4l2_ext_control *kcontrols;
> >  	u32 count;
> >  	u32 n;
> >  	compat_caddr_t p;
> >  
> > +	/*
> > +	 * We need to define kcontrols without __user, even though it does
> > +	 * point to data in userspace here. The reason is that v4l2-ioctl.c
> > +	 * copies it from userspace to kernelspace, so its definition in
> > +	 * videodev2.h doesn't have a __user markup. Defining kcontrols
> > +	 * with __user causes smatch warnings, so instead declare it
> > +	 * without __user and cast it as a userspace pointer where needed.
> > +	 */
> >  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> >  	    assign_in_user(&up->which, &kp->which) ||
> >  	    get_user(count, &kp->count) ||
> > @@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
> >  		unsigned int size = sizeof(*ucontrols);
> >  		u32 id;
> >  
> > -		if (get_user(id, &kcontrols->id) ||
> > +		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||  
> 
> Why use 'unsigned int' instead of u32? It's defined as __u32 in the header,
> so let's keep this consistent.

Makes sense.

It should be noticed, however, that, on all other similar casts that are
already there, it uses unsigned int:

drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          unsigned int size = sizeof(*ucontrols);
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          if (!err && assign_in_user((unsigned int __user *)up_native,
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:                             ((unsigned int __user *)up_native)))
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)

So, I tried to be consistent with that.

> 
> >  		    put_user(id, &ucontrols->id) ||
> > -		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
> > -		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
> > +		    assign_in_user(&ucontrols->size,
> > +				   (unsigned int __user *)&kcontrols->size) ||  
> 
> Same here.
> 
> > +		    copy_in_user(&ucontrols->reserved2,
> > +				 (unsigned int __user *)&kcontrols->reserved2,  
> 
> This can be a void __user *.

We should be very careful changing it to void. When I tested the first
version of this patchset, I noticed that the results produced by one
ioctl were different with v4l2-compliance, between 32/64 bits version,
because the type of the cast was wrong.

So, it should really match the type of the fields that will be copying,
as otherwise we may have troubles.

(same applies to your similar comments below)

> 
> >  				 sizeof(ucontrols->reserved2)))
> >  			return -EFAULT;
> >  
> > @@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
> >  		if (ctrl_is_pointer(file, id))
> >  			size -= sizeof(ucontrols->value64);
> >  
> > -		if (copy_in_user(ucontrols, kcontrols, size))
> > +		if (copy_in_user(ucontrols,
> > +			         (unsigned int __user *)kcontrols, size))  
> 
> void __user *
> 
> >  			return -EFAULT;
> >  
> >  		ucontrols++;
> > @@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
> >  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> >  	    assign_in_user(&kp->pad, &up->pad) ||
> >  	    assign_in_user(&kp->start_block, &up->start_block) ||
> > -	    assign_in_user(&kp->blocks, &up->blocks) ||
> > +	    assign_in_user(&kp->blocks,
> > +			   (unsigned char __user *)&up->blocks) ||  
> 
> ->blocks is a u32, so this should be a u32 cast as well.  
> 
> >  	    get_user(tmp, &up->edid) ||
> > -	    put_user(compat_ptr(tmp), &kp->edid) ||
> > +	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
> >  	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
> >  		return -EFAULT;
> >  	return 0;
> > @@ -970,7 +989,7 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
> >  	    assign_in_user(&up->start_block, &kp->start_block) ||
> >  	    assign_in_user(&up->blocks, &kp->blocks) ||
> >  	    get_user(edid, &kp->edid) ||
> > -	    put_user(ptr_to_compat(edid), &up->edid) ||
> > +	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
> >  	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
> >  		return -EFAULT;
> >  	return 0;
> >   
> 
> Regards,
> 
> 	Hans



Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Hans Verkuil]

On 04/17/18 12:53, Mauro Carvalho Chehab wrote:
> Em Tue, 17 Apr 2018 12:33:11 +0200
> Hans Verkuil <hansverk@cisco.com> escreveu:
> 
>> On 04/17/18 12:20, Mauro Carvalho Chehab wrote:
>>> Smatch report several issues with bad __user annotations:
>>>
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid
>>>
>>> Fix them.
>>>
>>> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
>>> ---
>>>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
>>>  1 file changed, 35 insertions(+), 16 deletions(-)
>>>
>>> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>>> index d03a44d89649..c951ac3faf46 100644
>>> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>>> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>>> @@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
>>>  			return -EFAULT;
>>>  		break;
>>>  	case V4L2_MEMORY_USERPTR:
>>> -		if (get_user(p, &up->m.userptr) ||
>>> -		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
>>> +		if (get_user(p, &up->m.userptr)||
>>> +		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
>>>  			     &up32->m.userptr))
>>>  			return -EFAULT;
>>>  		break;
>>> @@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>>>  	u32 length;
>>>  	enum v4l2_memory memory;
>>>  	struct v4l2_plane32 __user *uplane32;
>>> -	struct v4l2_plane __user *uplane;
>>> +	struct v4l2_plane *uplane;
>>>  	compat_caddr_t p;
>>>  	int ret;
>>>  
>>> @@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>>>  
>>>  		if (num_planes == 0)
>>>  			return 0;
>>> -
>>> -		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
>>> +		/* We need to define uplane without __user, even though
>>> +		 * it does point to data in userspace here. The reason is
>>> +		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
>>> +		 * so its definition in videodev2.h doesn't have a
>>> +		 * __user markup. Defining uplane with __user causes
>>> +		 * smatch warnings, so instead declare it without __user
>>> +		 * and cast it as a userspace pointer to put_v4l2_plane32().
>>> +		 */
>>> +		if (get_user(uplane, &kp->m.planes))
>>>  			return -EFAULT;
>>>  		if (get_user(p, &up->m.planes))
>>>  			return -EFAULT;
>>>  		uplane32 = compat_ptr(p);
>>>  
>>>  		while (num_planes--) {
>>> -			ret = put_v4l2_plane32(uplane, uplane32, memory);
>>> +			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
>>>  			if (ret)
>>>  				return ret;
>>>  			++uplane;
>>> @@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
>>>  
>>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
>>>  	    get_user(tmp, &up->base) ||
>>> -	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
>>> +	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
>>>  	    assign_in_user(&kp->capability, &up->capability) ||
>>>  	    assign_in_user(&kp->flags, &up->flags) ||
>>>  	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
>>> @@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
>>>  
>>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
>>>  	    get_user(base, &kp->base) ||
>>> -	    put_user(ptr_to_compat(base), &up->base) ||
>>> +	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
>>>  	    assign_in_user(&up->capability, &kp->capability) ||
>>>  	    assign_in_user(&up->flags, &kp->flags) ||
>>>  	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
>>> @@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
>>>  				   struct v4l2_ext_controls32 __user *up)
>>>  {
>>>  	struct v4l2_ext_control32 __user *ucontrols;
>>> -	struct v4l2_ext_control __user *kcontrols;
>>> +	struct v4l2_ext_control *kcontrols;
>>>  	u32 count;
>>>  	u32 n;
>>>  	compat_caddr_t p;
>>>  
>>> +	/*
>>> +	 * We need to define kcontrols without __user, even though it does
>>> +	 * point to data in userspace here. The reason is that v4l2-ioctl.c
>>> +	 * copies it from userspace to kernelspace, so its definition in
>>> +	 * videodev2.h doesn't have a __user markup. Defining kcontrols
>>> +	 * with __user causes smatch warnings, so instead declare it
>>> +	 * without __user and cast it as a userspace pointer where needed.
>>> +	 */
>>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
>>>  	    assign_in_user(&up->which, &kp->which) ||
>>>  	    get_user(count, &kp->count) ||
>>> @@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
>>>  		unsigned int size = sizeof(*ucontrols);
>>>  		u32 id;
>>>  
>>> -		if (get_user(id, &kcontrols->id) ||
>>> +		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||  
>>
>> Why use 'unsigned int' instead of u32? It's defined as __u32 in the header,
>> so let's keep this consistent.
> 
> Makes sense.
> 
> It should be noticed, however, that, on all other similar casts that are
> already there, it uses unsigned int:
> 
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          unsigned int size = sizeof(*ucontrols);
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          if (!err && assign_in_user((unsigned int __user *)up_native,
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:                             ((unsigned int __user *)up_native)))
> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
> 
> So, I tried to be consistent with that.

Those casts are probably very old and they should be fixed at some point.

> 
>>
>>>  		    put_user(id, &ucontrols->id) ||
>>> -		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
>>> -		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
>>> +		    assign_in_user(&ucontrols->size,
>>> +				   (unsigned int __user *)&kcontrols->size) ||  
>>
>> Same here.
>>
>>> +		    copy_in_user(&ucontrols->reserved2,
>>> +				 (unsigned int __user *)&kcontrols->reserved2,  
>>
>> This can be a void __user *.
> 
> We should be very careful changing it to void. When I tested the first
> version of this patchset, I noticed that the results produced by one
> ioctl were different with v4l2-compliance, between 32/64 bits version,
> because the type of the cast was wrong.
> 
> So, it should really match the type of the fields that will be copying,
> as otherwise we may have troubles.

copy_in_user has void * arguments, and it is just a memcpy effectively.
There is no point in sticking to the field types (and it doesn't do that
either in this code).

> 
> (same applies to your similar comments below)
> 
>>
>>>  				 sizeof(ucontrols->reserved2)))
>>>  			return -EFAULT;
>>>  
>>> @@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
>>>  		if (ctrl_is_pointer(file, id))
>>>  			size -= sizeof(ucontrols->value64);
>>>  
>>> -		if (copy_in_user(ucontrols, kcontrols, size))
>>> +		if (copy_in_user(ucontrols,
>>> +			         (unsigned int __user *)kcontrols, size))  
>>
>> void __user *
>>
>>>  			return -EFAULT;
>>>  
>>>  		ucontrols++;
>>> @@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
>>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
>>>  	    assign_in_user(&kp->pad, &up->pad) ||
>>>  	    assign_in_user(&kp->start_block, &up->start_block) ||
>>> -	    assign_in_user(&kp->blocks, &up->blocks) ||
>>> +	    assign_in_user(&kp->blocks,
>>> +			   (unsigned char __user *)&up->blocks) ||  
>>
>> ->blocks is a u32, so this should be a u32 cast as well.  

Be aware that the unsigned char * cast is actually a bug: it will clamp the
u32 'blocks' value to a u8.

Regards,

	Hans

>>
>>>  	    get_user(tmp, &up->edid) ||
>>> -	    put_user(compat_ptr(tmp), &kp->edid) ||
>>> +	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
>>>  	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
>>>  		return -EFAULT;
>>>  	return 0;
>>> @@ -970,7 +989,7 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
>>>  	    assign_in_user(&up->start_block, &kp->start_block) ||
>>>  	    assign_in_user(&up->blocks, &kp->blocks) ||
>>>  	    get_user(edid, &kp->edid) ||
>>> -	    put_user(ptr_to_compat(edid), &up->edid) ||
>>> +	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
>>>  	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
>>>  		return -EFAULT;
>>>  	return 0;
>>>   
>>
>> Regards,
>>
>> 	Hans
> 
> 
> 
> Thanks,
> Mauro
> 

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 13:04:31 +0200
Hans Verkuil <hansverk@cisco.com> escreveu:

> On 04/17/18 12:53, Mauro Carvalho Chehab wrote:
> > Em Tue, 17 Apr 2018 12:33:11 +0200
> > Hans Verkuil <hansverk@cisco.com> escreveu:
> >   
> >> On 04/17/18 12:20, Mauro Carvalho Chehab wrote:  
> >>> Smatch report several issues with bad __user annotations:
> >>>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid
> >>>
> >>> Fix them.
> >>>
> >>> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> >>> ---
> >>>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
> >>>  1 file changed, 35 insertions(+), 16 deletions(-)
> >>>
> >>> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> >>> index d03a44d89649..c951ac3faf46 100644
> >>> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> >>> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> >>> @@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
> >>>  			return -EFAULT;
> >>>  		break;
> >>>  	case V4L2_MEMORY_USERPTR:
> >>> -		if (get_user(p, &up->m.userptr) ||
> >>> -		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
> >>> +		if (get_user(p, &up->m.userptr)||
> >>> +		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
> >>>  			     &up32->m.userptr))
> >>>  			return -EFAULT;
> >>>  		break;
> >>> @@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> >>>  	u32 length;
> >>>  	enum v4l2_memory memory;
> >>>  	struct v4l2_plane32 __user *uplane32;
> >>> -	struct v4l2_plane __user *uplane;
> >>> +	struct v4l2_plane *uplane;
> >>>  	compat_caddr_t p;
> >>>  	int ret;
> >>>  
> >>> @@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> >>>  
> >>>  		if (num_planes == 0)
> >>>  			return 0;
> >>> -
> >>> -		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
> >>> +		/* We need to define uplane without __user, even though
> >>> +		 * it does point to data in userspace here. The reason is
> >>> +		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
> >>> +		 * so its definition in videodev2.h doesn't have a
> >>> +		 * __user markup. Defining uplane with __user causes
> >>> +		 * smatch warnings, so instead declare it without __user
> >>> +		 * and cast it as a userspace pointer to put_v4l2_plane32().
> >>> +		 */
> >>> +		if (get_user(uplane, &kp->m.planes))
> >>>  			return -EFAULT;
> >>>  		if (get_user(p, &up->m.planes))
> >>>  			return -EFAULT;
> >>>  		uplane32 = compat_ptr(p);
> >>>  
> >>>  		while (num_planes--) {
> >>> -			ret = put_v4l2_plane32(uplane, uplane32, memory);
> >>> +			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
> >>>  			if (ret)
> >>>  				return ret;
> >>>  			++uplane;
> >>> @@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> >>>  
> >>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> >>>  	    get_user(tmp, &up->base) ||
> >>> -	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
> >>> +	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
> >>>  	    assign_in_user(&kp->capability, &up->capability) ||
> >>>  	    assign_in_user(&kp->flags, &up->flags) ||
> >>>  	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
> >>> @@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> >>>  
> >>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> >>>  	    get_user(base, &kp->base) ||
> >>> -	    put_user(ptr_to_compat(base), &up->base) ||
> >>> +	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
> >>>  	    assign_in_user(&up->capability, &kp->capability) ||
> >>>  	    assign_in_user(&up->flags, &kp->flags) ||
> >>>  	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
> >>> @@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
> >>>  				   struct v4l2_ext_controls32 __user *up)
> >>>  {
> >>>  	struct v4l2_ext_control32 __user *ucontrols;
> >>> -	struct v4l2_ext_control __user *kcontrols;
> >>> +	struct v4l2_ext_control *kcontrols;
> >>>  	u32 count;
> >>>  	u32 n;
> >>>  	compat_caddr_t p;
> >>>  
> >>> +	/*
> >>> +	 * We need to define kcontrols without __user, even though it does
> >>> +	 * point to data in userspace here. The reason is that v4l2-ioctl.c
> >>> +	 * copies it from userspace to kernelspace, so its definition in
> >>> +	 * videodev2.h doesn't have a __user markup. Defining kcontrols
> >>> +	 * with __user causes smatch warnings, so instead declare it
> >>> +	 * without __user and cast it as a userspace pointer where needed.
> >>> +	 */
> >>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> >>>  	    assign_in_user(&up->which, &kp->which) ||
> >>>  	    get_user(count, &kp->count) ||
> >>> @@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
> >>>  		unsigned int size = sizeof(*ucontrols);
> >>>  		u32 id;
> >>>  
> >>> -		if (get_user(id, &kcontrols->id) ||
> >>> +		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||    
> >>
> >> Why use 'unsigned int' instead of u32? It's defined as __u32 in the header,
> >> so let's keep this consistent.  
> > 
> > Makes sense.
> > 
> > It should be noticed, however, that, on all other similar casts that are
> > already there, it uses unsigned int:
> > 
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          unsigned int size = sizeof(*ucontrols);
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          if (!err && assign_in_user((unsigned int __user *)up_native,
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:                             ((unsigned int __user *)up_native)))
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
> > 
> > So, I tried to be consistent with that.  
> 
> Those casts are probably very old and they should be fixed at some point.

Sure, but, IMHO, the best is to do it on a separate patch.

> 
> >   
> >>  
> >>>  		    put_user(id, &ucontrols->id) ||
> >>> -		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
> >>> -		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
> >>> +		    assign_in_user(&ucontrols->size,
> >>> +				   (unsigned int __user *)&kcontrols->size) ||    
> >>
> >> Same here.
> >>  
> >>> +		    copy_in_user(&ucontrols->reserved2,
> >>> +				 (unsigned int __user *)&kcontrols->reserved2,    
> >>
> >> This can be a void __user *.  
> > 
> > We should be very careful changing it to void. When I tested the first
> > version of this patchset, I noticed that the results produced by one
> > ioctl were different with v4l2-compliance, between 32/64 bits version,
> > because the type of the cast was wrong.
> > 
> > So, it should really match the type of the fields that will be copying,
> > as otherwise we may have troubles.  
> 
> copy_in_user has void * arguments, and it is just a memcpy effectively.
> There is no point in sticking to the field types (and it doesn't do that
> either in this code).

I don't remember what routine caused compat32 issues, but I guess it was
a get_user/put_user/assign_in_user. There, the type is important.

Yeah, copy_in_user() can safely use void *. I'll switch all occurrences
with casts to void *.

> 
> > 
> > (same applies to your similar comments below)
> >   
> >>  
> >>>  				 sizeof(ucontrols->reserved2)))
> >>>  			return -EFAULT;
> >>>  
> >>> @@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
> >>>  		if (ctrl_is_pointer(file, id))
> >>>  			size -= sizeof(ucontrols->value64);
> >>>  
> >>> -		if (copy_in_user(ucontrols, kcontrols, size))
> >>> +		if (copy_in_user(ucontrols,
> >>> +			         (unsigned int __user *)kcontrols, size))    
> >>
> >> void __user *
> >>  
> >>>  			return -EFAULT;
> >>>  
> >>>  		ucontrols++;
> >>> @@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
> >>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> >>>  	    assign_in_user(&kp->pad, &up->pad) ||
> >>>  	    assign_in_user(&kp->start_block, &up->start_block) ||
> >>> -	    assign_in_user(&kp->blocks, &up->blocks) ||
> >>> +	    assign_in_user(&kp->blocks,
> >>> +			   (unsigned char __user *)&up->blocks) ||    
> >>  
> >> ->blocks is a u32, so this should be a u32 cast as well.    
> 
> Be aware that the unsigned char * cast is actually a bug: it will clamp the
> u32 'blocks' value to a u8.

True.

I'll write a separate patch addressing the cast types and will run some
tests to be sure that v4l2-compliance won't produce any error.

The above issue, however (u8 instead of u32) is something that I suspect
that the compliance tool won't catch. So, I won't doubt that we have
some hidden bugs at the compat code.

> 
> Regards,
> 
> 	Hans
> 
> >>  
> >>>  	    get_user(tmp, &up->edid) ||
> >>> -	    put_user(compat_ptr(tmp), &kp->edid) ||
> >>> +	    put_user((void __force *)compat_ptr(tmp), &kp->edid) ||
> >>>  	    copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
> >>>  		return -EFAULT;
> >>>  	return 0;
> >>> @@ -970,7 +989,7 @@ static int put_v4l2_edid32(struct v4l2_edid __user *kp,
> >>>  	    assign_in_user(&up->start_block, &kp->start_block) ||
> >>>  	    assign_in_user(&up->blocks, &kp->blocks) ||
> >>>  	    get_user(edid, &kp->edid) ||
> >>> -	    put_user(ptr_to_compat(edid), &up->edid) ||
> >>> +	    put_user(ptr_to_compat((void __user *)edid), &up->edid) ||
> >>>  	    copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)))
> >>>  		return -EFAULT;
> >>>  	return 0;
> >>>     
> >>
> >> Regards,
> >>
> >> 	Hans  
> > 
> > 
> > 
> > Thanks,
> > Mauro
> >   
> 



Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 13:04:31 +0200
Hans Verkuil <hansverk@cisco.com> escreveu:

> On 04/17/18 12:53, Mauro Carvalho Chehab wrote:
> > Em Tue, 17 Apr 2018 12:33:11 +0200
> > Hans Verkuil <hansverk@cisco.com> escreveu:
> >   
> >> On 04/17/18 12:20, Mauro Carvalho Chehab wrote:  
> >>> Smatch report several issues with bad __user annotations:
> >>>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
> >>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid
> >>>
> >>> Fix them.
> >>>
> >>> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> >>> ---
> >>>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
> >>>  1 file changed, 35 insertions(+), 16 deletions(-)
> >>>
> >>> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> >>> index d03a44d89649..c951ac3faf46 100644
> >>> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> >>> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> >>> @@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
> >>>  			return -EFAULT;
> >>>  		break;
> >>>  	case V4L2_MEMORY_USERPTR:
> >>> -		if (get_user(p, &up->m.userptr) ||
> >>> -		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
> >>> +		if (get_user(p, &up->m.userptr)||
> >>> +		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
> >>>  			     &up32->m.userptr))
> >>>  			return -EFAULT;
> >>>  		break;
> >>> @@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> >>>  	u32 length;
> >>>  	enum v4l2_memory memory;
> >>>  	struct v4l2_plane32 __user *uplane32;
> >>> -	struct v4l2_plane __user *uplane;
> >>> +	struct v4l2_plane *uplane;
> >>>  	compat_caddr_t p;
> >>>  	int ret;
> >>>  
> >>> @@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
> >>>  
> >>>  		if (num_planes == 0)
> >>>  			return 0;
> >>> -
> >>> -		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
> >>> +		/* We need to define uplane without __user, even though
> >>> +		 * it does point to data in userspace here. The reason is
> >>> +		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
> >>> +		 * so its definition in videodev2.h doesn't have a
> >>> +		 * __user markup. Defining uplane with __user causes
> >>> +		 * smatch warnings, so instead declare it without __user
> >>> +		 * and cast it as a userspace pointer to put_v4l2_plane32().
> >>> +		 */
> >>> +		if (get_user(uplane, &kp->m.planes))
> >>>  			return -EFAULT;
> >>>  		if (get_user(p, &up->m.planes))
> >>>  			return -EFAULT;
> >>>  		uplane32 = compat_ptr(p);
> >>>  
> >>>  		while (num_planes--) {
> >>> -			ret = put_v4l2_plane32(uplane, uplane32, memory);
> >>> +			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
> >>>  			if (ret)
> >>>  				return ret;
> >>>  			++uplane;
> >>> @@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> >>>  
> >>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> >>>  	    get_user(tmp, &up->base) ||
> >>> -	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
> >>> +	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
> >>>  	    assign_in_user(&kp->capability, &up->capability) ||
> >>>  	    assign_in_user(&kp->flags, &up->flags) ||
> >>>  	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
> >>> @@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
> >>>  
> >>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> >>>  	    get_user(base, &kp->base) ||
> >>> -	    put_user(ptr_to_compat(base), &up->base) ||
> >>> +	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
> >>>  	    assign_in_user(&up->capability, &kp->capability) ||
> >>>  	    assign_in_user(&up->flags, &kp->flags) ||
> >>>  	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
> >>> @@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
> >>>  				   struct v4l2_ext_controls32 __user *up)
> >>>  {
> >>>  	struct v4l2_ext_control32 __user *ucontrols;
> >>> -	struct v4l2_ext_control __user *kcontrols;
> >>> +	struct v4l2_ext_control *kcontrols;
> >>>  	u32 count;
> >>>  	u32 n;
> >>>  	compat_caddr_t p;
> >>>  
> >>> +	/*
> >>> +	 * We need to define kcontrols without __user, even though it does
> >>> +	 * point to data in userspace here. The reason is that v4l2-ioctl.c
> >>> +	 * copies it from userspace to kernelspace, so its definition in
> >>> +	 * videodev2.h doesn't have a __user markup. Defining kcontrols
> >>> +	 * with __user causes smatch warnings, so instead declare it
> >>> +	 * without __user and cast it as a userspace pointer where needed.
> >>> +	 */
> >>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
> >>>  	    assign_in_user(&up->which, &kp->which) ||
> >>>  	    get_user(count, &kp->count) ||
> >>> @@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
> >>>  		unsigned int size = sizeof(*ucontrols);
> >>>  		u32 id;
> >>>  
> >>> -		if (get_user(id, &kcontrols->id) ||
> >>> +		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||    
> >>
> >> Why use 'unsigned int' instead of u32? It's defined as __u32 in the header,
> >> so let's keep this consistent.  
> > 
> > Makes sense.
> > 
> > It should be noticed, however, that, on all other similar casts that are
> > already there, it uses unsigned int:
> > 
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          unsigned int size = sizeof(*ucontrols);
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          if (!err && assign_in_user((unsigned int __user *)up_native,
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:                             ((unsigned int __user *)up_native)))
> > drivers/media/v4l2-core/v4l2-compat-ioctl32.c:long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
> > 
> > So, I tried to be consistent with that.  
> 
> Those casts are probably very old and they should be fixed at some point.
> 
> >   
> >>  
> >>>  		    put_user(id, &ucontrols->id) ||
> >>> -		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
> >>> -		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
> >>> +		    assign_in_user(&ucontrols->size,
> >>> +				   (unsigned int __user *)&kcontrols->size) ||    
> >>
> >> Same here.
> >>  
> >>> +		    copy_in_user(&ucontrols->reserved2,
> >>> +				 (unsigned int __user *)&kcontrols->reserved2,    
> >>
> >> This can be a void __user *.  
> > 
> > We should be very careful changing it to void. When I tested the first
> > version of this patchset, I noticed that the results produced by one
> > ioctl were different with v4l2-compliance, between 32/64 bits version,
> > because the type of the cast was wrong.
> > 
> > So, it should really match the type of the fields that will be copying,
> > as otherwise we may have troubles.  
> 
> copy_in_user has void * arguments, and it is just a memcpy effectively.
> There is no point in sticking to the field types (and it doesn't do that
> either in this code).
> 
> > 
> > (same applies to your similar comments below)
> >   
> >>  
> >>>  				 sizeof(ucontrols->reserved2)))
> >>>  			return -EFAULT;
> >>>  
> >>> @@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
> >>>  		if (ctrl_is_pointer(file, id))
> >>>  			size -= sizeof(ucontrols->value64);
> >>>  
> >>> -		if (copy_in_user(ucontrols, kcontrols, size))
> >>> +		if (copy_in_user(ucontrols,
> >>> +			         (unsigned int __user *)kcontrols, size))    
> >>
> >> void __user *
> >>  
> >>>  			return -EFAULT;
> >>>  
> >>>  		ucontrols++;
> >>> @@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
> >>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
> >>>  	    assign_in_user(&kp->pad, &up->pad) ||
> >>>  	    assign_in_user(&kp->start_block, &up->start_block) ||
> >>> -	    assign_in_user(&kp->blocks, &up->blocks) ||
> >>> +	    assign_in_user(&kp->blocks,
> >>> +			   (unsigned char __user *)&up->blocks) ||    
> >>  
> >> ->blocks is a u32, so this should be a u32 cast as well.    
> 
> Be aware that the unsigned char * cast is actually a bug: it will clamp the
> u32 'blocks' value to a u8.
> 
> Regards,
> 
> 	Hans

What about this approach (code untested)?

Btw, I'm planning to do it as a separate patch... the p64/p32 patch makes
a way harder to fold it back with patch 4/5:

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 8c05dd9660d3..4602a50211b9 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -30,6 +30,16 @@
 	get_user(__assign_tmp, from) || put_user(__assign_tmp, to);	\
 })
 
+#define get_user_cast(__x, __ptr)					\
+({									\
+	get_user(__x, (typeof(*__ptr) __user *)(__ptr));		\
+})
+
+#define put_user_force(__x, __ptr)					\
+({									\
+	put_user((typeof(*__x) __force *)(__x), __ptr);			\
+})
+
 static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	long ret = -ENOIOCTLCMD;
@@ -543,8 +553,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
 			return -EFAULT;
 
 		uplane = aux_buf;
-		if (put_user((__force struct v4l2_plane *)uplane,
-			     &p64->m.planes))
+		if (put_user_force(uplane, &p64->m.planes))
 			return -EFAULT;
 
 		while (num_planes--) {
@@ -682,7 +691,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
 
 	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
 	    get_user(tmp, &p32->base) ||
-	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
+	    put_user_force(compat_ptr(tmp), &p64->base) ||
 	    assign_in_user(&p64->capability, &p32->capability) ||
 	    assign_in_user(&p64->flags, &p32->flags) ||
 	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
@@ -831,8 +840,7 @@ static int get_v4l2_ext_controls32(struct file *file,
 	if (aux_space < count * sizeof(*kcontrols))
 		return -EFAULT;
 	kcontrols = aux_buf;
-	if (put_user((__force struct v4l2_ext_control *)kcontrols,
-		     &p64->controls))
+	if (put_user_force(kcontrols, &p64->controls))
 		return -EFAULT;
 
 	for (n = 0; n < count; n++) {
@@ -859,6 +867,9 @@ static int get_v4l2_ext_controls32(struct file *file,
 	return 0;
 }
 
+
+
+
 static int put_v4l2_ext_controls32(struct file *file,
 				   struct v4l2_ext_controls __user *p64,
 				   struct v4l2_ext_controls32 __user *p32)
@@ -898,12 +909,12 @@ static int put_v4l2_ext_controls32(struct file *file,
 		unsigned int size = sizeof(*ucontrols);
 		u32 id;
 
-		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||
+		if (get_user_cast(id, &kcontrols->id) ||
 		    put_user(id, &ucontrols->id) ||
 		    assign_in_user(&ucontrols->size,
-				   (unsigned int __user *)&kcontrols->size) ||
+				   (__u32 __user *)&kcontrols->size) ||
 		    copy_in_user(&ucontrols->reserved2,
-				 (unsigned int __user *)&kcontrols->reserved2,
+				 (void __user *)&kcontrols->reserved2,
 				 sizeof(ucontrols->reserved2)))
 			return -EFAULT;
 
@@ -916,7 +927,7 @@ static int put_v4l2_ext_controls32(struct file *file,
 			size -= sizeof(ucontrols->value64);
 
 		if (copy_in_user(ucontrols,
-			         (unsigned int __user *)kcontrols, size))
+			         (void __user *)kcontrols, size))
 			return -EFAULT;
 
 		ucontrols++;
@@ -971,9 +982,9 @@ static int get_v4l2_edid32(struct v4l2_edid __user *p64,
 	    assign_in_user(&p64->pad, &p32->pad) ||
 	    assign_in_user(&p64->start_block, &p32->start_block) ||
 	    assign_in_user(&p64->blocks,
-			   (unsigned char __user *)&p32->blocks) ||
+			   (__u32 __user *)&p32->blocks) ||
 	    get_user(tmp, &p32->edid) ||
-	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
+	    put_user_force(compat_ptr(tmp), &p64->edid) ||
 	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
 		return -EFAULT;
 	return 0;

Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 10:01:31 -0300
Mauro Carvalho Chehab <mchehab@s-opensource.com> escreveu:

> > >> ->blocks is a u32, so this should be a u32 cast as well.    
> > 
> > Be aware that the unsigned char * cast is actually a bug: it will clamp the
> > u32 'blocks' value to a u8.
> > 
> > Regards,
> > 
> > 	Hans
> 
> What about this approach (code untested)?

Even better:

[PATCH] media: v4l2-compat-ioctl32: simplify casts

Making the cast right for get_user/put_user is not trivial, as
it needs to ensure that the types are the correct ones.

Improve it by using macros.

PS.: Patch untested

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 8c05dd9660d3..d2f0268427c2 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -30,6 +30,24 @@
 	get_user(__assign_tmp, from) || put_user(__assign_tmp, to);	\
 })
 
+#define get_user_cast(__x, __ptr)					\
+({									\
+	get_user(__x, (typeof(*__ptr) __user *)(__ptr));		\
+})
+
+#define put_user_force(__x, __ptr)					\
+({									\
+	put_user((typeof(*__x) __force *)(__x), __ptr);			\
+})
+
+#define assign_in_user_cast(to, from)					\
+({									\
+	typeof(*from) __assign_tmp;					\
+									\
+	get_user_cast(__assign_tmp, from) || put_user(__assign_tmp, to);\
+})
+
+
 static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	long ret = -ENOIOCTLCMD;
@@ -543,8 +561,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
 			return -EFAULT;
 
 		uplane = aux_buf;
-		if (put_user((__force struct v4l2_plane *)uplane,
-			     &p64->m.planes))
+		if (put_user_force(uplane, &p64->m.planes))
 			return -EFAULT;
 
 		while (num_planes--) {
@@ -682,7 +699,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
 
 	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
 	    get_user(tmp, &p32->base) ||
-	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
+	    put_user_force(compat_ptr(tmp), &p64->base) ||
 	    assign_in_user(&p64->capability, &p32->capability) ||
 	    assign_in_user(&p64->flags, &p32->flags) ||
 	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
@@ -831,8 +848,7 @@ static int get_v4l2_ext_controls32(struct file *file,
 	if (aux_space < count * sizeof(*kcontrols))
 		return -EFAULT;
 	kcontrols = aux_buf;
-	if (put_user((__force struct v4l2_ext_control *)kcontrols,
-		     &p64->controls))
+	if (put_user_force(kcontrols, &p64->controls))
 		return -EFAULT;
 
 	for (n = 0; n < count; n++) {
@@ -898,12 +914,11 @@ static int put_v4l2_ext_controls32(struct file *file,
 		unsigned int size = sizeof(*ucontrols);
 		u32 id;
 
-		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||
+		if (get_user_cast(id, &kcontrols->id) ||
 		    put_user(id, &ucontrols->id) ||
-		    assign_in_user(&ucontrols->size,
-				   (unsigned int __user *)&kcontrols->size) ||
+		    assign_in_user_cast(&ucontrols->size, &kcontrols->size) ||
 		    copy_in_user(&ucontrols->reserved2,
-				 (unsigned int __user *)&kcontrols->reserved2,
+				 (void __user *)&kcontrols->reserved2,
 				 sizeof(ucontrols->reserved2)))
 			return -EFAULT;
 
@@ -916,7 +931,7 @@ static int put_v4l2_ext_controls32(struct file *file,
 			size -= sizeof(ucontrols->value64);
 
 		if (copy_in_user(ucontrols,
-			         (unsigned int __user *)kcontrols, size))
+			         (void __user *)kcontrols, size))
 			return -EFAULT;
 
 		ucontrols++;
@@ -970,10 +985,9 @@ static int get_v4l2_edid32(struct v4l2_edid __user *p64,
 	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
 	    assign_in_user(&p64->pad, &p32->pad) ||
 	    assign_in_user(&p64->start_block, &p32->start_block) ||
-	    assign_in_user(&p64->blocks,
-			   (unsigned char __user *)&p32->blocks) ||
+	    assign_in_user_cast(&p64->blocks, &p32->blocks) ||
 	    get_user(tmp, &p32->edid) ||
-	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
+	    put_user_force(compat_ptr(tmp), &p64->edid) ||
 	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
 		return -EFAULT;
 	return 0;


Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Hans Verkuil]

On 04/17/18 15:01, Mauro Carvalho Chehab wrote:
> Em Tue, 17 Apr 2018 13:04:31 +0200
> Hans Verkuil <hansverk@cisco.com> escreveu:
> 
>> On 04/17/18 12:53, Mauro Carvalho Chehab wrote:
>>> Em Tue, 17 Apr 2018 12:33:11 +0200
>>> Hans Verkuil <hansverk@cisco.com> escreveu:
>>>   
>>>> On 04/17/18 12:20, Mauro Carvalho Chehab wrote:  
>>>>> Smatch report several issues with bad __user annotations:
>>>>>
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21: warning: incorrect type in argument 1 (different address spaces)
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    expected void [noderef] <asn:1>*uptr
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:447:21:    got void *<noident>
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21: warning: incorrect type in argument 1 (different address spaces)
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    expected void const volatile [noderef] <asn:1>*<noident>
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:621:21:    got struct v4l2_plane [noderef] <asn:1>**<noident>
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13: warning: incorrect type in argument 1 (different address spaces)
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    expected void [noderef] <asn:1>*uptr
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:693:13:    got void *[assigned] base
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13: warning: incorrect type in assignment (different address spaces)
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    expected struct v4l2_ext_control [noderef] <asn:1>*kcontrols
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:871:13:    got struct v4l2_ext_control *<noident>
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13: warning: incorrect type in assignment (different address spaces)
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    expected unsigned char [usertype] *__pu_val
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:957:13:    got void [noderef] <asn:1>*
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13: warning: incorrect type in argument 1 (different address spaces)
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    expected void [noderef] <asn:1>*uptr
>>>>>   drivers/media/v4l2-core/v4l2-compat-ioctl32.c:973:13:    got void *[assigned] edid
>>>>>
>>>>> Fix them.
>>>>>
>>>>> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
>>>>> ---
>>>>>  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 51 ++++++++++++++++++---------
>>>>>  1 file changed, 35 insertions(+), 16 deletions(-)
>>>>>
>>>>> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>>>>> index d03a44d89649..c951ac3faf46 100644
>>>>> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>>>>> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
>>>>> @@ -443,8 +443,8 @@ static int put_v4l2_plane32(struct v4l2_plane __user *up,
>>>>>  			return -EFAULT;
>>>>>  		break;
>>>>>  	case V4L2_MEMORY_USERPTR:
>>>>> -		if (get_user(p, &up->m.userptr) ||
>>>>> -		    put_user((compat_ulong_t)ptr_to_compat((__force void *)p),
>>>>> +		if (get_user(p, &up->m.userptr)||
>>>>> +		    put_user((compat_ulong_t)ptr_to_compat((void __user *)p),
>>>>>  			     &up32->m.userptr))
>>>>>  			return -EFAULT;
>>>>>  		break;
>>>>> @@ -587,7 +587,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>>>>>  	u32 length;
>>>>>  	enum v4l2_memory memory;
>>>>>  	struct v4l2_plane32 __user *uplane32;
>>>>> -	struct v4l2_plane __user *uplane;
>>>>> +	struct v4l2_plane *uplane;
>>>>>  	compat_caddr_t p;
>>>>>  	int ret;
>>>>>  
>>>>> @@ -617,15 +617,22 @@ static int put_v4l2_buffer32(struct v4l2_buffer __user *kp,
>>>>>  
>>>>>  		if (num_planes == 0)
>>>>>  			return 0;
>>>>> -
>>>>> -		if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes)))
>>>>> +		/* We need to define uplane without __user, even though
>>>>> +		 * it does point to data in userspace here. The reason is
>>>>> +		 * that v4l2-ioctl.c copies it from userspace to kernelspace,
>>>>> +		 * so its definition in videodev2.h doesn't have a
>>>>> +		 * __user markup. Defining uplane with __user causes
>>>>> +		 * smatch warnings, so instead declare it without __user
>>>>> +		 * and cast it as a userspace pointer to put_v4l2_plane32().
>>>>> +		 */
>>>>> +		if (get_user(uplane, &kp->m.planes))
>>>>>  			return -EFAULT;
>>>>>  		if (get_user(p, &up->m.planes))
>>>>>  			return -EFAULT;
>>>>>  		uplane32 = compat_ptr(p);
>>>>>  
>>>>>  		while (num_planes--) {
>>>>> -			ret = put_v4l2_plane32(uplane, uplane32, memory);
>>>>> +			ret = put_v4l2_plane32((void __user *)uplane, uplane32, memory);
>>>>>  			if (ret)
>>>>>  				return ret;
>>>>>  			++uplane;
>>>>> @@ -675,7 +682,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
>>>>>  
>>>>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
>>>>>  	    get_user(tmp, &up->base) ||
>>>>> -	    put_user((__force void *)compat_ptr(tmp), &kp->base) ||
>>>>> +	    put_user((void __force *)compat_ptr(tmp), &kp->base) ||
>>>>>  	    assign_in_user(&kp->capability, &up->capability) ||
>>>>>  	    assign_in_user(&kp->flags, &up->flags) ||
>>>>>  	    copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt)))
>>>>> @@ -690,7 +697,7 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp,
>>>>>  
>>>>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
>>>>>  	    get_user(base, &kp->base) ||
>>>>> -	    put_user(ptr_to_compat(base), &up->base) ||
>>>>> +	    put_user(ptr_to_compat((void __user *)base), &up->base) ||
>>>>>  	    assign_in_user(&up->capability, &kp->capability) ||
>>>>>  	    assign_in_user(&up->flags, &kp->flags) ||
>>>>>  	    copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt)))
>>>>> @@ -857,11 +864,19 @@ static int put_v4l2_ext_controls32(struct file *file,
>>>>>  				   struct v4l2_ext_controls32 __user *up)
>>>>>  {
>>>>>  	struct v4l2_ext_control32 __user *ucontrols;
>>>>> -	struct v4l2_ext_control __user *kcontrols;
>>>>> +	struct v4l2_ext_control *kcontrols;
>>>>>  	u32 count;
>>>>>  	u32 n;
>>>>>  	compat_caddr_t p;
>>>>>  
>>>>> +	/*
>>>>> +	 * We need to define kcontrols without __user, even though it does
>>>>> +	 * point to data in userspace here. The reason is that v4l2-ioctl.c
>>>>> +	 * copies it from userspace to kernelspace, so its definition in
>>>>> +	 * videodev2.h doesn't have a __user markup. Defining kcontrols
>>>>> +	 * with __user causes smatch warnings, so instead declare it
>>>>> +	 * without __user and cast it as a userspace pointer where needed.
>>>>> +	 */
>>>>>  	if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
>>>>>  	    assign_in_user(&up->which, &kp->which) ||
>>>>>  	    get_user(count, &kp->count) ||
>>>>> @@ -883,10 +898,12 @@ static int put_v4l2_ext_controls32(struct file *file,
>>>>>  		unsigned int size = sizeof(*ucontrols);
>>>>>  		u32 id;
>>>>>  
>>>>> -		if (get_user(id, &kcontrols->id) ||
>>>>> +		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||    
>>>>
>>>> Why use 'unsigned int' instead of u32? It's defined as __u32 in the header,
>>>> so let's keep this consistent.  
>>>
>>> Makes sense.
>>>
>>> It should be noticed, however, that, on all other similar casts that are
>>> already there, it uses unsigned int:
>>>
>>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          unsigned int size = sizeof(*ucontrols);
>>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
>>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          if (!err && assign_in_user((unsigned int __user *)up_native,
>>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:          err = alloc_userspace(sizeof(unsigned int), 0, &up_native);
>>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:                             ((unsigned int __user *)up_native)))
>>> drivers/media/v4l2-core/v4l2-compat-ioctl32.c:long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
>>>
>>> So, I tried to be consistent with that.  
>>
>> Those casts are probably very old and they should be fixed at some point.
>>
>>>   
>>>>  
>>>>>  		    put_user(id, &ucontrols->id) ||
>>>>> -		    assign_in_user(&ucontrols->size, &kcontrols->size) ||
>>>>> -		    copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2,
>>>>> +		    assign_in_user(&ucontrols->size,
>>>>> +				   (unsigned int __user *)&kcontrols->size) ||    
>>>>
>>>> Same here.
>>>>  
>>>>> +		    copy_in_user(&ucontrols->reserved2,
>>>>> +				 (unsigned int __user *)&kcontrols->reserved2,    
>>>>
>>>> This can be a void __user *.  
>>>
>>> We should be very careful changing it to void. When I tested the first
>>> version of this patchset, I noticed that the results produced by one
>>> ioctl were different with v4l2-compliance, between 32/64 bits version,
>>> because the type of the cast was wrong.
>>>
>>> So, it should really match the type of the fields that will be copying,
>>> as otherwise we may have troubles.  
>>
>> copy_in_user has void * arguments, and it is just a memcpy effectively.
>> There is no point in sticking to the field types (and it doesn't do that
>> either in this code).
>>
>>>
>>> (same applies to your similar comments below)
>>>   
>>>>  
>>>>>  				 sizeof(ucontrols->reserved2)))
>>>>>  			return -EFAULT;
>>>>>  
>>>>> @@ -898,7 +915,8 @@ static int put_v4l2_ext_controls32(struct file *file,
>>>>>  		if (ctrl_is_pointer(file, id))
>>>>>  			size -= sizeof(ucontrols->value64);
>>>>>  
>>>>> -		if (copy_in_user(ucontrols, kcontrols, size))
>>>>> +		if (copy_in_user(ucontrols,
>>>>> +			         (unsigned int __user *)kcontrols, size))    
>>>>
>>>> void __user *
>>>>  
>>>>>  			return -EFAULT;
>>>>>  
>>>>>  		ucontrols++;
>>>>> @@ -952,9 +970,10 @@ static int get_v4l2_edid32(struct v4l2_edid __user *kp,
>>>>>  	if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
>>>>>  	    assign_in_user(&kp->pad, &up->pad) ||
>>>>>  	    assign_in_user(&kp->start_block, &up->start_block) ||
>>>>> -	    assign_in_user(&kp->blocks, &up->blocks) ||
>>>>> +	    assign_in_user(&kp->blocks,
>>>>> +			   (unsigned char __user *)&up->blocks) ||    
>>>>  
>>>> ->blocks is a u32, so this should be a u32 cast as well.    
>>
>> Be aware that the unsigned char * cast is actually a bug: it will clamp the
>> u32 'blocks' value to a u8.
>>
>> Regards,
>>
>> 	Hans
> 
> What about this approach (code untested)?

I prefer the explicit casts. These are special situations and hiding it in
defines makes it actually harder to follow.

Just my opinion.

Regards,

	Hans

> 
> Btw, I'm planning to do it as a separate patch... the p64/p32 patch makes
> a way harder to fold it back with patch 4/5:
> 
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 8c05dd9660d3..4602a50211b9 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -30,6 +30,16 @@
>  	get_user(__assign_tmp, from) || put_user(__assign_tmp, to);	\
>  })
>  
> +#define get_user_cast(__x, __ptr)					\
> +({									\
> +	get_user(__x, (typeof(*__ptr) __user *)(__ptr));		\
> +})
> +
> +#define put_user_force(__x, __ptr)					\
> +({									\
> +	put_user((typeof(*__x) __force *)(__x), __ptr);			\
> +})
> +
>  static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>  {
>  	long ret = -ENOIOCTLCMD;
> @@ -543,8 +553,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
>  			return -EFAULT;
>  
>  		uplane = aux_buf;
> -		if (put_user((__force struct v4l2_plane *)uplane,
> -			     &p64->m.planes))
> +		if (put_user_force(uplane, &p64->m.planes))
>  			return -EFAULT;
>  
>  		while (num_planes--) {
> @@ -682,7 +691,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
>  
>  	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
>  	    get_user(tmp, &p32->base) ||
> -	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
> +	    put_user_force(compat_ptr(tmp), &p64->base) ||
>  	    assign_in_user(&p64->capability, &p32->capability) ||
>  	    assign_in_user(&p64->flags, &p32->flags) ||
>  	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
> @@ -831,8 +840,7 @@ static int get_v4l2_ext_controls32(struct file *file,
>  	if (aux_space < count * sizeof(*kcontrols))
>  		return -EFAULT;
>  	kcontrols = aux_buf;
> -	if (put_user((__force struct v4l2_ext_control *)kcontrols,
> -		     &p64->controls))
> +	if (put_user_force(kcontrols, &p64->controls))
>  		return -EFAULT;
>  
>  	for (n = 0; n < count; n++) {
> @@ -859,6 +867,9 @@ static int get_v4l2_ext_controls32(struct file *file,
>  	return 0;
>  }
>  
> +
> +
> +
>  static int put_v4l2_ext_controls32(struct file *file,
>  				   struct v4l2_ext_controls __user *p64,
>  				   struct v4l2_ext_controls32 __user *p32)
> @@ -898,12 +909,12 @@ static int put_v4l2_ext_controls32(struct file *file,
>  		unsigned int size = sizeof(*ucontrols);
>  		u32 id;
>  
> -		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||
> +		if (get_user_cast(id, &kcontrols->id) ||
>  		    put_user(id, &ucontrols->id) ||
>  		    assign_in_user(&ucontrols->size,
> -				   (unsigned int __user *)&kcontrols->size) ||
> +				   (__u32 __user *)&kcontrols->size) ||
>  		    copy_in_user(&ucontrols->reserved2,
> -				 (unsigned int __user *)&kcontrols->reserved2,
> +				 (void __user *)&kcontrols->reserved2,
>  				 sizeof(ucontrols->reserved2)))
>  			return -EFAULT;
>  
> @@ -916,7 +927,7 @@ static int put_v4l2_ext_controls32(struct file *file,
>  			size -= sizeof(ucontrols->value64);
>  
>  		if (copy_in_user(ucontrols,
> -			         (unsigned int __user *)kcontrols, size))
> +			         (void __user *)kcontrols, size))
>  			return -EFAULT;
>  
>  		ucontrols++;
> @@ -971,9 +982,9 @@ static int get_v4l2_edid32(struct v4l2_edid __user *p64,
>  	    assign_in_user(&p64->pad, &p32->pad) ||
>  	    assign_in_user(&p64->start_block, &p32->start_block) ||
>  	    assign_in_user(&p64->blocks,
> -			   (unsigned char __user *)&p32->blocks) ||
> +			   (__u32 __user *)&p32->blocks) ||
>  	    get_user(tmp, &p32->edid) ||
> -	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
> +	    put_user_force(compat_ptr(tmp), &p64->edid) ||
>  	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
>  		return -EFAULT;
>  	return 0;
> 
> Thanks,
> Mauro
> 

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 15:11:10 +0200
Hans Verkuil <hansverk@cisco.com> escreveu:

> >> Be aware that the unsigned char * cast is actually a bug: it will clamp the
> >> u32 'blocks' value to a u8.
> >>
> >> Regards,
> >>
> >> 	Hans  
> > 
> > What about this approach (code untested)?  
> 
> I prefer the explicit casts. These are special situations and hiding it in
> defines makes it actually harder to follow.

There are just one special case there: USERPTR, where we force a cast
to unsigned long:

drivers/media/v4l2-core/v4l2-compat-ioctl32.c:              put_user((unsigned long)compat_ptr(p), &p64->m.userptr))
...
drivers/media/v4l2-core/v4l2-compat-ioctl32.c:                      put_user((unsigned long)compat_ptr(userptr),
drivers/media/v4l2-core/v4l2-compat-ioctl32.c-                               &p64->m.userptr))

I kept it out of the macros.

IMO, maintaining the code with the type_of() is more error-prune, as
the cast will be done the way it should. The cases where some other
cast like is needed - with is what it was done for USERPTR should
be explicit (and, btw, they should be properly documented why doing
that).

I don't remember anymore why it is casting to unsigned long,
but, based on v4l2-compliance tests, it seems that such cast works.

Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 10:10:09 -0300
Mauro Carvalho Chehab <mchehab@s-opensource.com> escreveu:

> Em Tue, 17 Apr 2018 10:01:31 -0300
> Mauro Carvalho Chehab <mchehab@s-opensource.com> escreveu:
> 
> > > >> ->blocks is a u32, so this should be a u32 cast as well.      
> > > 
> > > Be aware that the unsigned char * cast is actually a bug: it will clamp the
> > > u32 'blocks' value to a u8.
> > > 
> > > Regards,
> > > 
> > > 	Hans  
> > 
> > What about this approach (code untested)?  
> 
> Even better:
> 
> [PATCH] media: v4l2-compat-ioctl32: simplify casts
> 
> Making the cast right for get_user/put_user is not trivial, as
> it needs to ensure that the types are the correct ones.
> 
> Improve it by using macros.
> 
> PS.: Patch untested

Tested with:

	$ sudo modprobe vivid no_error_inj=1
	$ v4l2-compliance-32bits -a -s10 >32bits && v4l2-compliance-64bits -a -s10 > 64bits && diff 32bits 64bits

32 bits version results:

v4l2-compliance SHA   : bc71e4a67c6fbc5940062843bc41e7c8679634ce

Compliance test for device /dev/video0:

Driver Info:
	Driver name      : vivid
	Card type        : vivid
	Bus info         : platform:vivid-000
	Driver version   : 4.17.0
	Capabilities     : 0x853f0df7
		Video Capture
		Video Output
		Video Overlay
		VBI Capture
		VBI Output
		Sliced VBI Capture
		Sliced VBI Output
		RDS Capture
		RDS Output
		SDR Capture
		Tuner
		HW Frequency Seek
		Modulator
		Audio
		Radio
		Read/Write
		Streaming
		Extended Pix Format
		Device Capabilities
	Device Caps      : 0x05230005
		Video Capture
		Video Overlay
		Tuner
		Audio
		Read/Write
		Streaming
		Extended Pix Format

Required ioctls:
	test VIDIOC_QUERYCAP: OK

Allow for multiple opens:
	test second /dev/video0 open: OK
	test VIDIOC_QUERYCAP: OK
	test VIDIOC_G/S_PRIORITY: OK
	test for unlimited opens: OK

Debug ioctls:
	test VIDIOC_DBG_G/S_REGISTER: OK
	test VIDIOC_LOG_STATUS: OK

Input ioctls:
	test VIDIOC_G/S_TUNER/ENUM_FREQ_BANDS: OK
	test VIDIOC_G/S_FREQUENCY: OK
	test VIDIOC_S_HW_FREQ_SEEK: OK (Not Supported)
	test VIDIOC_ENUMAUDIO: OK
	test VIDIOC_G/S/ENUMINPUT: OK
	test VIDIOC_G/S_AUDIO: OK
	Inputs: 4 Audio Inputs: 2 Tuners: 1

Output ioctls:
	test VIDIOC_G/S_MODULATOR: OK (Not Supported)
	test VIDIOC_G/S_FREQUENCY: OK
	test VIDIOC_ENUMAUDOUT: OK (Not Supported)
	test VIDIOC_G/S/ENUMOUTPUT: OK (Not Supported)
	test VIDIOC_G/S_AUDOUT: OK (Not Supported)
	Outputs: 0 Audio Outputs: 0 Modulators: 0

Input/Output configuration ioctls:
	test VIDIOC_ENUM/G/S/QUERY_STD: OK
	test VIDIOC_ENUM/G/S/QUERY_DV_TIMINGS: OK
	test VIDIOC_DV_TIMINGS_CAP: OK
	test VIDIOC_G/S_EDID: OK

Control ioctls (Input 0):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 0):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK (Not Supported)
	test Composing: OK (Not Supported)
	test Scaling: OK (Not Supported)

Codec ioctls (Input 0):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 0):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Control ioctls (Input 1):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 1):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK
	test Composing: OK
	test Scaling: OK

Codec ioctls (Input 1):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 1):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Control ioctls (Input 2):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 2):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK
	test Composing: OK
	test Scaling: OK

Codec ioctls (Input 2):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 2):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Control ioctls (Input 3):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
		warn: v4l2-test-controls.cpp(825): V4L2_CID_DV_RX_POWER_PRESENT not found for input 3
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 3):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK
	test Composing: OK
	test Scaling: OK

Codec ioctls (Input 3):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 3):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Test input 0:

Streaming ioctls:
	test read/write: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Test input 1:

Streaming ioctls:
	test read/write: OK
		warn: v4l2-test-buffers.cpp(235): V4L2_BUF_FLAG_TIMECODE was used!

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Test input 2:

Streaming ioctls:
	test read/write: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Test input 3:

Streaming ioctls:
	test read/write: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Total: 118, Succeeded: 118, Failed: 0, Warnings: 2

64 bits result:


v4l2-compliance SHA   : bc71e4a67c6fbc5940062843bc41e7c8679634ce

Compliance test for device /dev/video0:

Driver Info:
	Driver name      : vivid
	Card type        : vivid
	Bus info         : platform:vivid-000
	Driver version   : 4.17.0
	Capabilities     : 0x853f0df7
		Video Capture
		Video Output
		Video Overlay
		VBI Capture
		VBI Output
		Sliced VBI Capture
		Sliced VBI Output
		RDS Capture
		RDS Output
		SDR Capture
		Tuner
		HW Frequency Seek
		Modulator
		Audio
		Radio
		Read/Write
		Streaming
		Extended Pix Format
		Device Capabilities
	Device Caps      : 0x05230005
		Video Capture
		Video Overlay
		Tuner
		Audio
		Read/Write
		Streaming
		Extended Pix Format

Required ioctls:
	test VIDIOC_QUERYCAP: OK

Allow for multiple opens:
	test second /dev/video0 open: OK
	test VIDIOC_QUERYCAP: OK
	test VIDIOC_G/S_PRIORITY: OK
	test for unlimited opens: OK

Debug ioctls:
	test VIDIOC_DBG_G/S_REGISTER: OK
	test VIDIOC_LOG_STATUS: OK

Input ioctls:
	test VIDIOC_G/S_TUNER/ENUM_FREQ_BANDS: OK
	test VIDIOC_G/S_FREQUENCY: OK
	test VIDIOC_S_HW_FREQ_SEEK: OK (Not Supported)
	test VIDIOC_ENUMAUDIO: OK
	test VIDIOC_G/S/ENUMINPUT: OK
	test VIDIOC_G/S_AUDIO: OK
	Inputs: 4 Audio Inputs: 2 Tuners: 1

Output ioctls:
	test VIDIOC_G/S_MODULATOR: OK (Not Supported)
	test VIDIOC_G/S_FREQUENCY: OK
	test VIDIOC_ENUMAUDOUT: OK (Not Supported)
	test VIDIOC_G/S/ENUMOUTPUT: OK (Not Supported)
	test VIDIOC_G/S_AUDOUT: OK (Not Supported)
	Outputs: 0 Audio Outputs: 0 Modulators: 0

Input/Output configuration ioctls:
	test VIDIOC_ENUM/G/S/QUERY_STD: OK
	test VIDIOC_ENUM/G/S/QUERY_DV_TIMINGS: OK
	test VIDIOC_DV_TIMINGS_CAP: OK
	test VIDIOC_G/S_EDID: OK

Control ioctls (Input 0):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 0):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK (Not Supported)
	test Composing: OK (Not Supported)
	test Scaling: OK (Not Supported)

Codec ioctls (Input 0):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 0):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Control ioctls (Input 1):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 1):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK
	test Composing: OK
	test Scaling: OK

Codec ioctls (Input 1):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 1):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Control ioctls (Input 2):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 2):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK
	test Composing: OK
	test Scaling: OK

Codec ioctls (Input 2):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 2):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Control ioctls (Input 3):
	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
	test VIDIOC_QUERYCTRL: OK
	test VIDIOC_G/S_CTRL: OK
	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
		warn: v4l2-test-controls.cpp(825): V4L2_CID_DV_RX_POWER_PRESENT not found for input 3
	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
	Standard Controls: 15 Private Controls: 39

Format ioctls (Input 3):
	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
	test VIDIOC_G/S_PARM: OK
	test VIDIOC_G_FBUF: OK
	test VIDIOC_G_FMT: OK
	test VIDIOC_TRY_FMT: OK
	test VIDIOC_S_FMT: OK
	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
	test Cropping: OK
	test Composing: OK
	test Scaling: OK

Codec ioctls (Input 3):
	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)

Buffer ioctls (Input 3):
	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
	test VIDIOC_EXPBUF: OK

Test input 0:

Streaming ioctls:
	test read/write: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Test input 1:

Streaming ioctls:
	test read/write: OK
		warn: v4l2-test-buffers.cpp(235): V4L2_BUF_FLAG_TIMECODE was used!

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Test input 2:

Streaming ioctls:
	test read/write: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Test input 3:

Streaming ioctls:
	test read/write: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test MMAP: OK

	Video Capture: Frame #000
	Video Capture: Frame #001
	Video Capture: Frame #002
	Video Capture: Frame #003
	Video Capture: Frame #004
	Video Capture: Frame #005
	Video Capture: Frame #006
	Video Capture: Frame #007
	Video Capture: Frame #008
	Video Capture: Frame #009
	                                                  

	Video Capture: Frame #000 (polling)
	Video Capture: Frame #001 (polling)
	Video Capture: Frame #002 (polling)
	Video Capture: Frame #003 (polling)
	Video Capture: Frame #004 (polling)
	Video Capture: Frame #005 (polling)
	Video Capture: Frame #006 (polling)
	Video Capture: Frame #007 (polling)
	Video Capture: Frame #008 (polling)
	Video Capture: Frame #009 (polling)
	                                                  
	test USERPTR: OK
	test DMABUF: Cannot test, specify --expbuf-device

Total: 118, Succeeded: 118, Failed: 0, Warnings: 2


> 
> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> 
> diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> index 8c05dd9660d3..d2f0268427c2 100644
> --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> @@ -30,6 +30,24 @@
>  	get_user(__assign_tmp, from) || put_user(__assign_tmp, to);	\
>  })
>  
> +#define get_user_cast(__x, __ptr)					\
> +({									\
> +	get_user(__x, (typeof(*__ptr) __user *)(__ptr));		\
> +})
> +
> +#define put_user_force(__x, __ptr)					\
> +({									\
> +	put_user((typeof(*__x) __force *)(__x), __ptr);			\
> +})
> +
> +#define assign_in_user_cast(to, from)					\
> +({									\
> +	typeof(*from) __assign_tmp;					\
> +									\
> +	get_user_cast(__assign_tmp, from) || put_user(__assign_tmp, to);\
> +})
> +
> +
>  static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
>  {
>  	long ret = -ENOIOCTLCMD;
> @@ -543,8 +561,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
>  			return -EFAULT;
>  
>  		uplane = aux_buf;
> -		if (put_user((__force struct v4l2_plane *)uplane,
> -			     &p64->m.planes))
> +		if (put_user_force(uplane, &p64->m.planes))
>  			return -EFAULT;
>  
>  		while (num_planes--) {
> @@ -682,7 +699,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
>  
>  	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
>  	    get_user(tmp, &p32->base) ||
> -	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
> +	    put_user_force(compat_ptr(tmp), &p64->base) ||
>  	    assign_in_user(&p64->capability, &p32->capability) ||
>  	    assign_in_user(&p64->flags, &p32->flags) ||
>  	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
> @@ -831,8 +848,7 @@ static int get_v4l2_ext_controls32(struct file *file,
>  	if (aux_space < count * sizeof(*kcontrols))
>  		return -EFAULT;
>  	kcontrols = aux_buf;
> -	if (put_user((__force struct v4l2_ext_control *)kcontrols,
> -		     &p64->controls))
> +	if (put_user_force(kcontrols, &p64->controls))
>  		return -EFAULT;
>  
>  	for (n = 0; n < count; n++) {
> @@ -898,12 +914,11 @@ static int put_v4l2_ext_controls32(struct file *file,
>  		unsigned int size = sizeof(*ucontrols);
>  		u32 id;
>  
> -		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||
> +		if (get_user_cast(id, &kcontrols->id) ||
>  		    put_user(id, &ucontrols->id) ||
> -		    assign_in_user(&ucontrols->size,
> -				   (unsigned int __user *)&kcontrols->size) ||
> +		    assign_in_user_cast(&ucontrols->size, &kcontrols->size) ||
>  		    copy_in_user(&ucontrols->reserved2,
> -				 (unsigned int __user *)&kcontrols->reserved2,
> +				 (void __user *)&kcontrols->reserved2,
>  				 sizeof(ucontrols->reserved2)))
>  			return -EFAULT;
>  
> @@ -916,7 +931,7 @@ static int put_v4l2_ext_controls32(struct file *file,
>  			size -= sizeof(ucontrols->value64);
>  
>  		if (copy_in_user(ucontrols,
> -			         (unsigned int __user *)kcontrols, size))
> +			         (void __user *)kcontrols, size))
>  			return -EFAULT;
>  
>  		ucontrols++;
> @@ -970,10 +985,9 @@ static int get_v4l2_edid32(struct v4l2_edid __user *p64,
>  	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
>  	    assign_in_user(&p64->pad, &p32->pad) ||
>  	    assign_in_user(&p64->start_block, &p32->start_block) ||
> -	    assign_in_user(&p64->blocks,
> -			   (unsigned char __user *)&p32->blocks) ||
> +	    assign_in_user_cast(&p64->blocks, &p32->blocks) ||
>  	    get_user(tmp, &p32->edid) ||
> -	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
> +	    put_user_force(compat_ptr(tmp), &p64->edid) ||
>  	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
>  		return -EFAULT;
>  	return 0;
> 
> 
> Thanks,
> Mauro



Thanks,
Mauro

Re: [PATCH 4/5] media: v4l2-compat-ioctl32: fix several __user annotations

[Mauro Carvalho Chehab]

Em Tue, 17 Apr 2018 10:58:24 -0300
Mauro Carvalho Chehab <mchehab@infradead.org> escreveu:

> Em Tue, 17 Apr 2018 10:10:09 -0300
> Mauro Carvalho Chehab <mchehab@s-opensource.com> escreveu:
> 
> > Em Tue, 17 Apr 2018 10:01:31 -0300
> > Mauro Carvalho Chehab <mchehab@s-opensource.com> escreveu:
> >   
> > > > >> ->blocks is a u32, so this should be a u32 cast as well.        
> > > > 
> > > > Be aware that the unsigned char * cast is actually a bug: it will clamp the
> > > > u32 'blocks' value to a u8.
> > > > 
> > > > Regards,
> > > > 
> > > > 	Hans    
> > > 
> > > What about this approach (code untested)?    
> > 
> > Even better:
> > 
> > [PATCH] media: v4l2-compat-ioctl32: simplify casts
> > 
> > Making the cast right for get_user/put_user is not trivial, as
> > it needs to ensure that the types are the correct ones.
> > 
> > Improve it by using macros.
> > 
> > PS.: Patch untested  
> 
> Tested with:
> 
> 	$ sudo modprobe vivid no_error_inj=1
> 	$ v4l2-compliance-32bits -a -s10 >32bits && v4l2-compliance-64bits -a -s10 > 64bits && diff 32bits 64bits

As I was not running the very latest version of v4l2-compliance,
I applied this patch to both 32 and 64 bit versions of it:

	https://patchwork.linuxtv.org/patch/48746/

Rebuilt and re-run. Those are the results:

 $ v4l2-compliance-32bits -a -s10 >32bits && v4l2-compliance-64bits -a -s10 > 64bits && diff -U0 32bits 64bits
--- 32bits	2018-04-17 11:18:29.141240772 -0300
+++ 64bits	2018-04-17 11:18:40.635282341 -0300
@@ -1 +1 @@
-v4l2-compliance SHA   : bc71e4a67c6fbc5940062843bc41e7c8679634ce, 32 bits
+v4l2-compliance SHA   : bc71e4a67c6fbc5940062843bc41e7c8679634ce, 64 bits

Hans,

Please check this patch and apply if you think it is worth:
	https://patchwork.linuxtv.org/patch/48746/

> 
> 32 bits version results:
> 
> v4l2-compliance SHA   : bc71e4a67c6fbc5940062843bc41e7c8679634ce
> 
> Compliance test for device /dev/video0:
> 
> Driver Info:
> 	Driver name      : vivid
> 	Card type        : vivid
> 	Bus info         : platform:vivid-000
> 	Driver version   : 4.17.0
> 	Capabilities     : 0x853f0df7
> 		Video Capture
> 		Video Output
> 		Video Overlay
> 		VBI Capture
> 		VBI Output
> 		Sliced VBI Capture
> 		Sliced VBI Output
> 		RDS Capture
> 		RDS Output
> 		SDR Capture
> 		Tuner
> 		HW Frequency Seek
> 		Modulator
> 		Audio
> 		Radio
> 		Read/Write
> 		Streaming
> 		Extended Pix Format
> 		Device Capabilities
> 	Device Caps      : 0x05230005
> 		Video Capture
> 		Video Overlay
> 		Tuner
> 		Audio
> 		Read/Write
> 		Streaming
> 		Extended Pix Format
> 
> Required ioctls:
> 	test VIDIOC_QUERYCAP: OK
> 
> Allow for multiple opens:
> 	test second /dev/video0 open: OK
> 	test VIDIOC_QUERYCAP: OK
> 	test VIDIOC_G/S_PRIORITY: OK
> 	test for unlimited opens: OK
> 
> Debug ioctls:
> 	test VIDIOC_DBG_G/S_REGISTER: OK
> 	test VIDIOC_LOG_STATUS: OK
> 
> Input ioctls:
> 	test VIDIOC_G/S_TUNER/ENUM_FREQ_BANDS: OK
> 	test VIDIOC_G/S_FREQUENCY: OK
> 	test VIDIOC_S_HW_FREQ_SEEK: OK (Not Supported)
> 	test VIDIOC_ENUMAUDIO: OK
> 	test VIDIOC_G/S/ENUMINPUT: OK
> 	test VIDIOC_G/S_AUDIO: OK
> 	Inputs: 4 Audio Inputs: 2 Tuners: 1
> 
> Output ioctls:
> 	test VIDIOC_G/S_MODULATOR: OK (Not Supported)
> 	test VIDIOC_G/S_FREQUENCY: OK
> 	test VIDIOC_ENUMAUDOUT: OK (Not Supported)
> 	test VIDIOC_G/S/ENUMOUTPUT: OK (Not Supported)
> 	test VIDIOC_G/S_AUDOUT: OK (Not Supported)
> 	Outputs: 0 Audio Outputs: 0 Modulators: 0
> 
> Input/Output configuration ioctls:
> 	test VIDIOC_ENUM/G/S/QUERY_STD: OK
> 	test VIDIOC_ENUM/G/S/QUERY_DV_TIMINGS: OK
> 	test VIDIOC_DV_TIMINGS_CAP: OK
> 	test VIDIOC_G/S_EDID: OK
> 
> Control ioctls (Input 0):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 0):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK (Not Supported)
> 	test Composing: OK (Not Supported)
> 	test Scaling: OK (Not Supported)
> 
> Codec ioctls (Input 0):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 0):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Control ioctls (Input 1):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 1):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK
> 	test Composing: OK
> 	test Scaling: OK
> 
> Codec ioctls (Input 1):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 1):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Control ioctls (Input 2):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 2):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK
> 	test Composing: OK
> 	test Scaling: OK
> 
> Codec ioctls (Input 2):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 2):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Control ioctls (Input 3):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 		warn: v4l2-test-controls.cpp(825): V4L2_CID_DV_RX_POWER_PRESENT not found for input 3
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 3):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK
> 	test Composing: OK
> 	test Scaling: OK
> 
> Codec ioctls (Input 3):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 3):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Test input 0:
> 
> Streaming ioctls:
> 	test read/write: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Test input 1:
> 
> Streaming ioctls:
> 	test read/write: OK
> 		warn: v4l2-test-buffers.cpp(235): V4L2_BUF_FLAG_TIMECODE was used!
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Test input 2:
> 
> Streaming ioctls:
> 	test read/write: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Test input 3:
> 
> Streaming ioctls:
> 	test read/write: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Total: 118, Succeeded: 118, Failed: 0, Warnings: 2
> 
> 64 bits result:
> 
> 
> v4l2-compliance SHA   : bc71e4a67c6fbc5940062843bc41e7c8679634ce
> 
> Compliance test for device /dev/video0:
> 
> Driver Info:
> 	Driver name      : vivid
> 	Card type        : vivid
> 	Bus info         : platform:vivid-000
> 	Driver version   : 4.17.0
> 	Capabilities     : 0x853f0df7
> 		Video Capture
> 		Video Output
> 		Video Overlay
> 		VBI Capture
> 		VBI Output
> 		Sliced VBI Capture
> 		Sliced VBI Output
> 		RDS Capture
> 		RDS Output
> 		SDR Capture
> 		Tuner
> 		HW Frequency Seek
> 		Modulator
> 		Audio
> 		Radio
> 		Read/Write
> 		Streaming
> 		Extended Pix Format
> 		Device Capabilities
> 	Device Caps      : 0x05230005
> 		Video Capture
> 		Video Overlay
> 		Tuner
> 		Audio
> 		Read/Write
> 		Streaming
> 		Extended Pix Format
> 
> Required ioctls:
> 	test VIDIOC_QUERYCAP: OK
> 
> Allow for multiple opens:
> 	test second /dev/video0 open: OK
> 	test VIDIOC_QUERYCAP: OK
> 	test VIDIOC_G/S_PRIORITY: OK
> 	test for unlimited opens: OK
> 
> Debug ioctls:
> 	test VIDIOC_DBG_G/S_REGISTER: OK
> 	test VIDIOC_LOG_STATUS: OK
> 
> Input ioctls:
> 	test VIDIOC_G/S_TUNER/ENUM_FREQ_BANDS: OK
> 	test VIDIOC_G/S_FREQUENCY: OK
> 	test VIDIOC_S_HW_FREQ_SEEK: OK (Not Supported)
> 	test VIDIOC_ENUMAUDIO: OK
> 	test VIDIOC_G/S/ENUMINPUT: OK
> 	test VIDIOC_G/S_AUDIO: OK
> 	Inputs: 4 Audio Inputs: 2 Tuners: 1
> 
> Output ioctls:
> 	test VIDIOC_G/S_MODULATOR: OK (Not Supported)
> 	test VIDIOC_G/S_FREQUENCY: OK
> 	test VIDIOC_ENUMAUDOUT: OK (Not Supported)
> 	test VIDIOC_G/S/ENUMOUTPUT: OK (Not Supported)
> 	test VIDIOC_G/S_AUDOUT: OK (Not Supported)
> 	Outputs: 0 Audio Outputs: 0 Modulators: 0
> 
> Input/Output configuration ioctls:
> 	test VIDIOC_ENUM/G/S/QUERY_STD: OK
> 	test VIDIOC_ENUM/G/S/QUERY_DV_TIMINGS: OK
> 	test VIDIOC_DV_TIMINGS_CAP: OK
> 	test VIDIOC_G/S_EDID: OK
> 
> Control ioctls (Input 0):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 0):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK (Not Supported)
> 	test Composing: OK (Not Supported)
> 	test Scaling: OK (Not Supported)
> 
> Codec ioctls (Input 0):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 0):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Control ioctls (Input 1):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 1):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK
> 	test Composing: OK
> 	test Scaling: OK
> 
> Codec ioctls (Input 1):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 1):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Control ioctls (Input 2):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 2):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK
> 	test Composing: OK
> 	test Scaling: OK
> 
> Codec ioctls (Input 2):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 2):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Control ioctls (Input 3):
> 	test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: OK
> 	test VIDIOC_QUERYCTRL: OK
> 	test VIDIOC_G/S_CTRL: OK
> 	test VIDIOC_G/S/TRY_EXT_CTRLS: OK
> 		warn: v4l2-test-controls.cpp(825): V4L2_CID_DV_RX_POWER_PRESENT not found for input 3
> 	test VIDIOC_(UN)SUBSCRIBE_EVENT/DQEVENT: OK
> 	test VIDIOC_G/S_JPEGCOMP: OK (Not Supported)
> 	Standard Controls: 15 Private Controls: 39
> 
> Format ioctls (Input 3):
> 	test VIDIOC_ENUM_FMT/FRAMESIZES/FRAMEINTERVALS: OK
> 	test VIDIOC_G/S_PARM: OK
> 	test VIDIOC_G_FBUF: OK
> 	test VIDIOC_G_FMT: OK
> 	test VIDIOC_TRY_FMT: OK
> 	test VIDIOC_S_FMT: OK
> 	test VIDIOC_G_SLICED_VBI_CAP: OK (Not Supported)
> 	test Cropping: OK
> 	test Composing: OK
> 	test Scaling: OK
> 
> Codec ioctls (Input 3):
> 	test VIDIOC_(TRY_)ENCODER_CMD: OK (Not Supported)
> 	test VIDIOC_G_ENC_INDEX: OK (Not Supported)
> 	test VIDIOC_(TRY_)DECODER_CMD: OK (Not Supported)
> 
> Buffer ioctls (Input 3):
> 	test VIDIOC_REQBUFS/CREATE_BUFS/QUERYBUF: OK
> 	test VIDIOC_EXPBUF: OK
> 
> Test input 0:
> 
> Streaming ioctls:
> 	test read/write: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Test input 1:
> 
> Streaming ioctls:
> 	test read/write: OK
> 		warn: v4l2-test-buffers.cpp(235): V4L2_BUF_FLAG_TIMECODE was used!
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Test input 2:
> 
> Streaming ioctls:
> 	test read/write: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Test input 3:
> 
> Streaming ioctls:
> 	test read/write: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test MMAP: OK
> 
> 	Video Capture: Frame #000
> 	Video Capture: Frame #001
> 	Video Capture: Frame #002
> 	Video Capture: Frame #003
> 	Video Capture: Frame #004
> 	Video Capture: Frame #005
> 	Video Capture: Frame #006
> 	Video Capture: Frame #007
> 	Video Capture: Frame #008
> 	Video Capture: Frame #009
> 	                                                  
> 
> 	Video Capture: Frame #000 (polling)
> 	Video Capture: Frame #001 (polling)
> 	Video Capture: Frame #002 (polling)
> 	Video Capture: Frame #003 (polling)
> 	Video Capture: Frame #004 (polling)
> 	Video Capture: Frame #005 (polling)
> 	Video Capture: Frame #006 (polling)
> 	Video Capture: Frame #007 (polling)
> 	Video Capture: Frame #008 (polling)
> 	Video Capture: Frame #009 (polling)
> 	                                                  
> 	test USERPTR: OK
> 	test DMABUF: Cannot test, specify --expbuf-device
> 
> Total: 118, Succeeded: 118, Failed: 0, Warnings: 2
> 
> 
> > 
> > Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
> > 
> > diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > index 8c05dd9660d3..d2f0268427c2 100644
> > --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
> > @@ -30,6 +30,24 @@
> >  	get_user(__assign_tmp, from) || put_user(__assign_tmp, to);	\
> >  })
> >  
> > +#define get_user_cast(__x, __ptr)					\
> > +({									\
> > +	get_user(__x, (typeof(*__ptr) __user *)(__ptr));		\
> > +})
> > +
> > +#define put_user_force(__x, __ptr)					\
> > +({									\
> > +	put_user((typeof(*__x) __force *)(__x), __ptr);			\
> > +})
> > +
> > +#define assign_in_user_cast(to, from)					\
> > +({									\
> > +	typeof(*from) __assign_tmp;					\
> > +									\
> > +	get_user_cast(__assign_tmp, from) || put_user(__assign_tmp, to);\
> > +})
> > +
> > +
> >  static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
> >  {
> >  	long ret = -ENOIOCTLCMD;
> > @@ -543,8 +561,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer __user *p64,
> >  			return -EFAULT;
> >  
> >  		uplane = aux_buf;
> > -		if (put_user((__force struct v4l2_plane *)uplane,
> > -			     &p64->m.planes))
> > +		if (put_user_force(uplane, &p64->m.planes))
> >  			return -EFAULT;
> >  
> >  		while (num_planes--) {
> > @@ -682,7 +699,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *p64,
> >  
> >  	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> >  	    get_user(tmp, &p32->base) ||
> > -	    put_user((void __force *)compat_ptr(tmp), &p64->base) ||
> > +	    put_user_force(compat_ptr(tmp), &p64->base) ||
> >  	    assign_in_user(&p64->capability, &p32->capability) ||
> >  	    assign_in_user(&p64->flags, &p32->flags) ||
> >  	    copy_in_user(&p64->fmt, &p32->fmt, sizeof(p64->fmt)))
> > @@ -831,8 +848,7 @@ static int get_v4l2_ext_controls32(struct file *file,
> >  	if (aux_space < count * sizeof(*kcontrols))
> >  		return -EFAULT;
> >  	kcontrols = aux_buf;
> > -	if (put_user((__force struct v4l2_ext_control *)kcontrols,
> > -		     &p64->controls))
> > +	if (put_user_force(kcontrols, &p64->controls))
> >  		return -EFAULT;
> >  
> >  	for (n = 0; n < count; n++) {
> > @@ -898,12 +914,11 @@ static int put_v4l2_ext_controls32(struct file *file,
> >  		unsigned int size = sizeof(*ucontrols);
> >  		u32 id;
> >  
> > -		if (get_user(id, (unsigned int __user *)&kcontrols->id) ||
> > +		if (get_user_cast(id, &kcontrols->id) ||
> >  		    put_user(id, &ucontrols->id) ||
> > -		    assign_in_user(&ucontrols->size,
> > -				   (unsigned int __user *)&kcontrols->size) ||
> > +		    assign_in_user_cast(&ucontrols->size, &kcontrols->size) ||
> >  		    copy_in_user(&ucontrols->reserved2,
> > -				 (unsigned int __user *)&kcontrols->reserved2,
> > +				 (void __user *)&kcontrols->reserved2,
> >  				 sizeof(ucontrols->reserved2)))
> >  			return -EFAULT;
> >  
> > @@ -916,7 +931,7 @@ static int put_v4l2_ext_controls32(struct file *file,
> >  			size -= sizeof(ucontrols->value64);
> >  
> >  		if (copy_in_user(ucontrols,
> > -			         (unsigned int __user *)kcontrols, size))
> > +			         (void __user *)kcontrols, size))
> >  			return -EFAULT;
> >  
> >  		ucontrols++;
> > @@ -970,10 +985,9 @@ static int get_v4l2_edid32(struct v4l2_edid __user *p64,
> >  	if (!access_ok(VERIFY_READ, p32, sizeof(*p32)) ||
> >  	    assign_in_user(&p64->pad, &p32->pad) ||
> >  	    assign_in_user(&p64->start_block, &p32->start_block) ||
> > -	    assign_in_user(&p64->blocks,
> > -			   (unsigned char __user *)&p32->blocks) ||
> > +	    assign_in_user_cast(&p64->blocks, &p32->blocks) ||
> >  	    get_user(tmp, &p32->edid) ||
> > -	    put_user((void __force *)compat_ptr(tmp), &p64->edid) ||
> > +	    put_user_force(compat_ptr(tmp), &p64->edid) ||
> >  	    copy_in_user(p64->reserved, p32->reserved, sizeof(p64->reserved)))
> >  		return -EFAULT;
> >  	return 0;
> > 
> > 
> > Thanks,
> > Mauro  
> 
> 
> 
> Thanks,
> Mauro



Thanks,
Mauro

Re: [PATCH 0/5] Remaining COMPILE_TEST and smatch cleanups

[Mauro Carvalho Chehab]

Em Wed, 18 Apr 2018 12:04:14 +0300
Sakari Ailus <sakari.ailus@iki.fi> escreveu:

> On Tue, Apr 17, 2018 at 06:20:10AM -0400, Mauro Carvalho Chehab wrote:
> > There were several interactions at the COMPILE_TEST and smatch
> > patch series. While I applied most of them, there are 5 patches that
> > I kept out of it. The omap3 patch that were in my tree was the old
> > one. So, I'm re-posting it.
> > 
> > The ioctl32 patches are the latest version. Let's repost it to get some
> > acks, as this patch touches at V4L2 core, so a careful review is
> > always a good idea.
> > 
> > Arnd Bergmann (1):
> >   media: omap3isp: allow it to build with COMPILE_TEST
> > 
> > Laurent Pinchart (1):
> >   media: omap3isp: Enable driver compilation on ARM with COMPILE_TEST
> > 
> > Mauro Carvalho Chehab (3):
> >   omap: omap-iommu.h: allow building drivers with COMPILE_TEST
> >   media: v4l2-compat-ioctl32: fix several __user annotations
> >   media: v4l2-compat-ioctl32: better name userspace pointers
> > 
> >  drivers/media/platform/Kconfig                |   7 +-
> >  drivers/media/platform/omap3isp/isp.c         |   8 +
> >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 623 +++++++++++++-------------
> >  include/linux/omap-iommu.h                    |   5 +
> >  4 files changed, 338 insertions(+), 305 deletions(-)  
> 
> For patches 1 and 2:
> 
> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>

What about patch 3?

> 
> I'd like to see a new versions of patches 4 and 5; I agree on the naming
> change.

With what changes?

> Could you set the To: header to a valid value going forward? It's not a
> valid e-mail address but still contains "<" character which causes trouble
> when replying to the patches.

I've no idea how to fix it. When I submit patches, I don't add any To:
header (as the "to" is meant to be the one that will apply the patches...
sending an e-mail to myself seems too mad for my taste). Somewhere
between git-send-email, my SMTP local host or the SMTP smart gateway,
or something afterwards, a "fake" To: gets introduced.


Thanks,
Mauro

Re: [PATCH 0/5] Remaining COMPILE_TEST and smatch cleanups

[Sakari Ailus]

Hi Mauro,

On Thu, Apr 19, 2018 at 07:42:28AM -0300, Mauro Carvalho Chehab wrote:
> Em Wed, 18 Apr 2018 12:04:14 +0300
> Sakari Ailus <sakari.ailus@iki.fi> escreveu:
> 
> > On Tue, Apr 17, 2018 at 06:20:10AM -0400, Mauro Carvalho Chehab wrote:
> > > There were several interactions at the COMPILE_TEST and smatch
> > > patch series. While I applied most of them, there are 5 patches that
> > > I kept out of it. The omap3 patch that were in my tree was the old
> > > one. So, I'm re-posting it.
> > > 
> > > The ioctl32 patches are the latest version. Let's repost it to get some
> > > acks, as this patch touches at V4L2 core, so a careful review is
> > > always a good idea.
> > > 
> > > Arnd Bergmann (1):
> > >   media: omap3isp: allow it to build with COMPILE_TEST
> > > 
> > > Laurent Pinchart (1):
> > >   media: omap3isp: Enable driver compilation on ARM with COMPILE_TEST
> > > 
> > > Mauro Carvalho Chehab (3):
> > >   omap: omap-iommu.h: allow building drivers with COMPILE_TEST
> > >   media: v4l2-compat-ioctl32: fix several __user annotations
> > >   media: v4l2-compat-ioctl32: better name userspace pointers
> > > 
> > >  drivers/media/platform/Kconfig                |   7 +-
> > >  drivers/media/platform/omap3isp/isp.c         |   8 +
> > >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 623 +++++++++++++-------------
> > >  include/linux/omap-iommu.h                    |   5 +
> > >  4 files changed, 338 insertions(+), 305 deletions(-)  
> > 
> > For patches 1 and 2:
> > 
> > Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> 
> What about patch 3?
> 
> > 
> > I'd like to see a new versions of patches 4 and 5; I agree on the naming
> > change.
> 
> With what changes?

Hans had comments on patch 5 at least (moving changes to 3rd patch), that
may affect 4th patch as well.

> 
> > Could you set the To: header to a valid value going forward? It's not a
> > valid e-mail address but still contains "<" character which causes trouble
> > when replying to the patches.
> 
> I've no idea how to fix it. When I submit patches, I don't add any To:
> header (as the "to" is meant to be the one that will apply the patches...
> sending an e-mail to myself seems too mad for my taste). Somewhere
> between git-send-email, my SMTP local host or the SMTP smart gateway,
> or something afterwards, a "fake" To: gets introduced.

To header isn't about who is going to apply the patches but who they
concern the most. How about addressing the mail to the linux-media list?
That's what everyone else does, unless they are sending the patches to
certain recipients, which they could do for a number of reasons.

The invalid To: header effectively leads to unintentional off-list
discussion.

-- 
Kind regards,

Sakari Ailus
e-mail: sakari.ailus@iki.fi

Re: [PATCH 0/5] Remaining COMPILE_TEST and smatch cleanups

[Mauro Carvalho Chehab]

Em Mon, 23 Apr 2018 17:09:19 +0300
Sakari Ailus <sakari.ailus@iki.fi> escreveu:

> Hi Mauro,
> 
> On Thu, Apr 19, 2018 at 07:42:28AM -0300, Mauro Carvalho Chehab wrote:
> > Em Wed, 18 Apr 2018 12:04:14 +0300
> > Sakari Ailus <sakari.ailus@iki.fi> escreveu:
> >   
> > > On Tue, Apr 17, 2018 at 06:20:10AM -0400, Mauro Carvalho Chehab wrote:  
> > > > There were several interactions at the COMPILE_TEST and smatch
> > > > patch series. While I applied most of them, there are 5 patches that
> > > > I kept out of it. The omap3 patch that were in my tree was the old
> > > > one. So, I'm re-posting it.
> > > > 
> > > > The ioctl32 patches are the latest version. Let's repost it to get some
> > > > acks, as this patch touches at V4L2 core, so a careful review is
> > > > always a good idea.
> > > > 
> > > > Arnd Bergmann (1):
> > > >   media: omap3isp: allow it to build with COMPILE_TEST
> > > > 
> > > > Laurent Pinchart (1):
> > > >   media: omap3isp: Enable driver compilation on ARM with COMPILE_TEST
> > > > 
> > > > Mauro Carvalho Chehab (3):
> > > >   omap: omap-iommu.h: allow building drivers with COMPILE_TEST
> > > >   media: v4l2-compat-ioctl32: fix several __user annotations
> > > >   media: v4l2-compat-ioctl32: better name userspace pointers
> > > > 
> > > >  drivers/media/platform/Kconfig                |   7 +-
> > > >  drivers/media/platform/omap3isp/isp.c         |   8 +
> > > >  drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 623 +++++++++++++-------------
> > > >  include/linux/omap-iommu.h                    |   5 +
> > > >  4 files changed, 338 insertions(+), 305 deletions(-)    
> > > 
> > > For patches 1 and 2:
> > > 
> > > Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>  
> > 
> > What about patch 3?
> >   
> > > 
> > > I'd like to see a new versions of patches 4 and 5; I agree on the naming
> > > change.  
> > 
> > With what changes?  
> 
> Hans had comments on patch 5 at least (moving changes to 3rd patch), that
> may affect 4th patch as well.

All Hans comments were addressed at version 2 sent on Thru, and he already
gave his reviewed-by on Friday.

> > > Could you set the To: header to a valid value going forward? It's not a
> > > valid e-mail address but still contains "<" character which causes trouble
> > > when replying to the patches.  
> > 
> > I've no idea how to fix it. When I submit patches, I don't add any To:
> > header (as the "to" is meant to be the one that will apply the patches...
> > sending an e-mail to myself seems too mad for my taste). Somewhere
> > between git-send-email, my SMTP local host or the SMTP smart gateway,
> > or something afterwards, a "fake" To: gets introduced.  
> 
> To header isn't about who is going to apply the patches but who they
> concern the most. How about addressing the mail to the linux-media list?
> That's what everyone else does, unless they are sending the patches to
> certain recipients, which they could do for a number of reasons.
> 

If you look at Documentation/process/submitting-patches.rst, you'll see:

...
	5) Select the recipients for your patch
	---------------------------------------
...
	You should also normally choose at least one mailing list to receive a copy
	of your patch set. 

The thing is that a "To:" assumes that the one receiving it will be
applying the patch. This is sometimes not true for patches I write
lately, as they may be meant to be applied at linux-doc instead, when
they touches something related to doc-building system.

> The invalid To: header effectively leads to unintentional off-list
> discussion.

Yeah, I know this is bad. I'll seek for some time to look into it
more deeply.

Thanks,
Mauro