[PATCH 0/1] media: change media_device_request_alloc to match media_ioctl_info

[PATCH 0/1] media: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

*** BLURB HERE ***
Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
				       int *alloc_fd);

struct media_ioctl_info {
	unsigned int cmd;
	unsigned short flags;
	long (*fn)(struct media_device *dev, void *arg);
	long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
	long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

[PATCH 0/1] media: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

*** BLURB HERE ***
Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
				       int *alloc_fd);

struct media_ioctl_info {
	unsigned int cmd;
	unsigned short flags;
	long (*fn)(struct media_device *dev, void *arg);
	long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
	long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

[PATCH 0/1] media: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

*** BLURB HERE ***
Hello,

This patch is to modify media_device_request_alloc() so that it can pass
CFI(Control Flow Integrity) check. I would like some review comments.

media_device_request_alloc() is saved in fn of media_ioctl_info struct,
which is defined as long (*fn)(struct media_device *dev, void *arg). The
type of the second parameter of media_device_request_alloc() is int* now,
but it is void* in fn of media_ioctl_info. We got some ABI violation here.
Therefore, we would like to use void* instead of int* for the second
parameter of media_device_request_alloc().

static long media_device_request_alloc(struct media_device *mdev,
				       int *alloc_fd);

struct media_ioctl_info {
	unsigned int cmd;
	unsigned short flags;
	long (*fn)(struct media_device *dev, void *arg);
	long (*arg_from_user)(void *karg, void __user *uarg, unsigned int cmd);
	long (*arg_to_user)(void __user *uarg, void *karg, unsigned int cmd);
};


Here is an example. With Android’s CFI checking, we got the following error
without this change.

[   23.502477] mtk-cam soc:camisp: sd:mtk-cam raw-0 pad:2 set format w/h/code 2328/1748/0x3007
[   23.518690] Kernel panic - not syncing: CFI failure (target: media_device_request_alloc+0x0/0x4)
[   23.519804] CPU: 7 PID: 818 Comm: mtkv4l2_ut Tainted: G S         O      5.4.39-g02c0a4858bed-dirty #45
[   23.521553] Call trace:
[   23.521868]  dump_backtrace.cfi_jt+0x0/0x4
[   23.522389]  dump_stack+0xb8/0x114
[   23.522824]  panic+0x170/0x3e0
[   23.523215]  __ubsan_handle_cfi_check_fail_abort+0x0/0x14
[   23.523896]  perf_proc_update_handler+0x0/0xcc
[   23.524460]  __cfi_check+0x610cc/0x68ef0
[   23.524959]  media_device_ioctl+0x218/0x238
[   23.525488]  media_device_compat_ioctl+0x60/0x7c
[   23.526072]  media_compat_ioctl+0x58/0x9c
[   23.526581]  __arm64_compat_sys_ioctl+0x10c/0x434
[   23.527176]  el0_svc_common+0xb4/0x18c
[   23.527651]  el0_svc_compat_handler+0x1c/0x28
[   23.528202]  el0_svc_compat+0x8/0x24
[   23.528659] SMP: stopping secondary CPUs
[   23.529161] Kernel Offset: 0x24b8c00000 from 0xffffffc010000000
[   23.529906] PHYS_OFFSET: 0xffffffdd00000000
[   23.530434] CPU features: 0x00000006,2a80a238
[   23.530983] Memory Limit: none
PPL_LOG_STORE: check once, sig value 0x27, addr 0x116000.


Frederic Chen (1):
  media: mc-device.c: change media_device_request_alloc to match
    media_ioctl_info

 drivers/media/mc/mc-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

From: Frederic Chen <frederic.chen@mediatek.com>

We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
---
 drivers/media/mc/mc-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index da8088351135..bc5b5ecb6581 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 	return ret;
 }
 
-static long media_device_request_alloc(struct media_device *mdev,
-				       int *alloc_fd)
+static long media_device_request_alloc(struct media_device *mdev, void *arg)
 {
+	int *alloc_fd = arg;
+
 #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
 	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
 		return -ENOTTY;
-- 
2.18.0

[PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

From: Frederic Chen <frederic.chen@mediatek.com>

We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
---
 drivers/media/mc/mc-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index da8088351135..bc5b5ecb6581 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 	return ret;
 }
 
-static long media_device_request_alloc(struct media_device *mdev,
-				       int *alloc_fd)
+static long media_device_request_alloc(struct media_device *mdev, void *arg)
 {
+	int *alloc_fd = arg;
+
 #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
 	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
 		return -ENOTTY;
-- 
2.18.0
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

[PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[frederic.chen]

From: Frederic Chen <frederic.chen@mediatek.com>

We modified the type of media_device_request_alloc()'s second
parameter from int* to void* so that it can match the interface
defined in struct media_ioctl_info.

Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
---
 drivers/media/mc/mc-device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index da8088351135..bc5b5ecb6581 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
 	return ret;
 }
 
-static long media_device_request_alloc(struct media_device *mdev,
-				       int *alloc_fd)
+static long media_device_request_alloc(struct media_device *mdev, void *arg)
 {
+	int *alloc_fd = arg;
+
 #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
 	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
 		return -ENOTTY;
-- 
2.18.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Hans Verkuil]

On 06/08/2020 09:29, frederic.chen@mediatek.com wrote:
> From: Frederic Chen <frederic.chen@mediatek.com>
> 
> We modified the type of media_device_request_alloc()'s second
> parameter from int* to void* so that it can match the interface
> defined in struct media_ioctl_info.
> 
> Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
> ---
>  drivers/media/mc/mc-device.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index da8088351135..bc5b5ecb6581 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
>  	return ret;
>  }
>  
> -static long media_device_request_alloc(struct media_device *mdev,
> -				       int *alloc_fd)
> +static long media_device_request_alloc(struct media_device *mdev, void *arg)
>  {
> +	int *alloc_fd = arg;
> +
>  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
>  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
>  		return -ENOTTY;
> 

This change is fine, but the reason this wasn't noticed before is the cast in
the MEDIA_IOC_ARG define:

#define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)              \
        [_IOC_NR(MEDIA_IOC_##__cmd)] = {                                \
                .cmd = MEDIA_IOC_##__cmd,                               \
                .fn = (long (*)(struct media_device *, void *))func,    \
                .flags = fl,                                            \
                .arg_from_user = from_user,                             \
                .arg_to_user = to_user,                                 \
        }

When assigning to .fn the func is cast to a specific function prototype.
Without that cast the compiler would have warned about the mismatch.

I see no reason for that cast, so drop that cast as well.

Regards,

	Hans

Re: [PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Hans Verkuil]

On 06/08/2020 09:29, frederic.chen@mediatek.com wrote:
> From: Frederic Chen <frederic.chen@mediatek.com>
> 
> We modified the type of media_device_request_alloc()'s second
> parameter from int* to void* so that it can match the interface
> defined in struct media_ioctl_info.
> 
> Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
> ---
>  drivers/media/mc/mc-device.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index da8088351135..bc5b5ecb6581 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
>  	return ret;
>  }
>  
> -static long media_device_request_alloc(struct media_device *mdev,
> -				       int *alloc_fd)
> +static long media_device_request_alloc(struct media_device *mdev, void *arg)
>  {
> +	int *alloc_fd = arg;
> +
>  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
>  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
>  		return -ENOTTY;
> 

This change is fine, but the reason this wasn't noticed before is the cast in
the MEDIA_IOC_ARG define:

#define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)              \
        [_IOC_NR(MEDIA_IOC_##__cmd)] = {                                \
                .cmd = MEDIA_IOC_##__cmd,                               \
                .fn = (long (*)(struct media_device *, void *))func,    \
                .flags = fl,                                            \
                .arg_from_user = from_user,                             \
                .arg_to_user = to_user,                                 \
        }

When assigning to .fn the func is cast to a specific function prototype.
Without that cast the compiler would have warned about the mismatch.

I see no reason for that cast, so drop that cast as well.

Regards,

	Hans

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

Re: [PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Hans Verkuil]

On 06/08/2020 09:29, frederic.chen@mediatek.com wrote:
> From: Frederic Chen <frederic.chen@mediatek.com>
> 
> We modified the type of media_device_request_alloc()'s second
> parameter from int* to void* so that it can match the interface
> defined in struct media_ioctl_info.
> 
> Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
> ---
>  drivers/media/mc/mc-device.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> index da8088351135..bc5b5ecb6581 100644
> --- a/drivers/media/mc/mc-device.c
> +++ b/drivers/media/mc/mc-device.c
> @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
>  	return ret;
>  }
>  
> -static long media_device_request_alloc(struct media_device *mdev,
> -				       int *alloc_fd)
> +static long media_device_request_alloc(struct media_device *mdev, void *arg)
>  {
> +	int *alloc_fd = arg;
> +
>  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
>  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
>  		return -ENOTTY;
> 

This change is fine, but the reason this wasn't noticed before is the cast in
the MEDIA_IOC_ARG define:

#define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)              \
        [_IOC_NR(MEDIA_IOC_##__cmd)] = {                                \
                .cmd = MEDIA_IOC_##__cmd,                               \
                .fn = (long (*)(struct media_device *, void *))func,    \
                .flags = fl,                                            \
                .arg_from_user = from_user,                             \
                .arg_to_user = to_user,                                 \
        }

When assigning to .fn the func is cast to a specific function prototype.
Without that cast the compiler would have warned about the mismatch.

I see no reason for that cast, so drop that cast as well.

Regards,

	Hans

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Frederic Chen]

Dear Hans,

On Thu, 2020-08-06 at 09:42 +0200, Hans Verkuil wrote:
> On 06/08/2020 09:29, frederic.chen@mediatek.com wrote:
> > From: Frederic Chen <frederic.chen@mediatek.com>
> > 
> > We modified the type of media_device_request_alloc()'s second
> > parameter from int* to void* so that it can match the interface
> > defined in struct media_ioctl_info.
> > 
> > Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
> > ---
> >  drivers/media/mc/mc-device.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> > index da8088351135..bc5b5ecb6581 100644
> > --- a/drivers/media/mc/mc-device.c
> > +++ b/drivers/media/mc/mc-device.c
> > @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
> >  	return ret;
> >  }
> >  
> > -static long media_device_request_alloc(struct media_device *mdev,
> > -				       int *alloc_fd)
> > +static long media_device_request_alloc(struct media_device *mdev, void *arg)
> >  {
> > +	int *alloc_fd = arg;
> > +
> >  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
> >  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
> >  		return -ENOTTY;
> > 
> 
> This change is fine, but the reason this wasn't noticed before is the cast in
> the MEDIA_IOC_ARG define:
> 
> #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)              \
>         [_IOC_NR(MEDIA_IOC_##__cmd)] = {                                \
>                 .cmd = MEDIA_IOC_##__cmd,                               \
>                 .fn = (long (*)(struct media_device *, void *))func,    \
>                 .flags = fl,                                            \
>                 .arg_from_user = from_user,                             \
>                 .arg_to_user = to_user,                                 \
>         }
> 
> When assigning to .fn the func is cast to a specific function prototype.
> Without that cast the compiler would have warned about the mismatch.
> 
> I see no reason for that cast, so drop that cast as well.

I got it. I will remove the cast in the next patch.

> 
> Regards,
> 
> 	Hans


Sincerely,

Frederic Chen

Re: [PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Frederic Chen]

Dear Hans,

On Thu, 2020-08-06 at 09:42 +0200, Hans Verkuil wrote:
> On 06/08/2020 09:29, frederic.chen@mediatek.com wrote:
> > From: Frederic Chen <frederic.chen@mediatek.com>
> > 
> > We modified the type of media_device_request_alloc()'s second
> > parameter from int* to void* so that it can match the interface
> > defined in struct media_ioctl_info.
> > 
> > Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
> > ---
> >  drivers/media/mc/mc-device.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> > index da8088351135..bc5b5ecb6581 100644
> > --- a/drivers/media/mc/mc-device.c
> > +++ b/drivers/media/mc/mc-device.c
> > @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
> >  	return ret;
> >  }
> >  
> > -static long media_device_request_alloc(struct media_device *mdev,
> > -				       int *alloc_fd)
> > +static long media_device_request_alloc(struct media_device *mdev, void *arg)
> >  {
> > +	int *alloc_fd = arg;
> > +
> >  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
> >  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
> >  		return -ENOTTY;
> > 
> 
> This change is fine, but the reason this wasn't noticed before is the cast in
> the MEDIA_IOC_ARG define:
> 
> #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)              \
>         [_IOC_NR(MEDIA_IOC_##__cmd)] = {                                \
>                 .cmd = MEDIA_IOC_##__cmd,                               \
>                 .fn = (long (*)(struct media_device *, void *))func,    \
>                 .flags = fl,                                            \
>                 .arg_from_user = from_user,                             \
>                 .arg_to_user = to_user,                                 \
>         }
> 
> When assigning to .fn the func is cast to a specific function prototype.
> Without that cast the compiler would have warned about the mismatch.
> 
> I see no reason for that cast, so drop that cast as well.

I got it. I will remove the cast in the next patch.

> 
> Regards,
> 
> 	Hans


Sincerely,

Frederic Chen

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

Re: [PATCH V1] media: mc-device.c: change media_device_request_alloc to match media_ioctl_info

[Frederic Chen]

Dear Hans,

On Thu, 2020-08-06 at 09:42 +0200, Hans Verkuil wrote:
> On 06/08/2020 09:29, frederic.chen@mediatek.com wrote:
> > From: Frederic Chen <frederic.chen@mediatek.com>
> > 
> > We modified the type of media_device_request_alloc()'s second
> > parameter from int* to void* so that it can match the interface
> > defined in struct media_ioctl_info.
> > 
> > Signed-off-by: Frederic Chen <frederic.chen@mediatek.com>
> > ---
> >  drivers/media/mc/mc-device.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
> > index da8088351135..bc5b5ecb6581 100644
> > --- a/drivers/media/mc/mc-device.c
> > +++ b/drivers/media/mc/mc-device.c
> > @@ -370,9 +370,10 @@ static long media_device_get_topology(struct media_device *mdev, void *arg)
> >  	return ret;
> >  }
> >  
> > -static long media_device_request_alloc(struct media_device *mdev,
> > -				       int *alloc_fd)
> > +static long media_device_request_alloc(struct media_device *mdev, void *arg)
> >  {
> > +	int *alloc_fd = arg;
> > +
> >  #ifdef CONFIG_MEDIA_CONTROLLER_REQUEST_API
> >  	if (!mdev->ops || !mdev->ops->req_validate || !mdev->ops->req_queue)
> >  		return -ENOTTY;
> > 
> 
> This change is fine, but the reason this wasn't noticed before is the cast in
> the MEDIA_IOC_ARG define:
> 
> #define MEDIA_IOC_ARG(__cmd, func, fl, from_user, to_user)              \
>         [_IOC_NR(MEDIA_IOC_##__cmd)] = {                                \
>                 .cmd = MEDIA_IOC_##__cmd,                               \
>                 .fn = (long (*)(struct media_device *, void *))func,    \
>                 .flags = fl,                                            \
>                 .arg_from_user = from_user,                             \
>                 .arg_to_user = to_user,                                 \
>         }
> 
> When assigning to .fn the func is cast to a specific function prototype.
> Without that cast the compiler would have warned about the mismatch.
> 
> I see no reason for that cast, so drop that cast as well.

I got it. I will remove the cast in the next patch.

> 
> Regards,
> 
> 	Hans


Sincerely,

Frederic Chen

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel