* [PATCH for v5.18] v4l2-ioctl.c: fix incorrect error path
@ 2022-03-21 8:47 Hans Verkuil
2022-03-21 10:21 ` Hans Verkuil
0 siblings, 1 reply; 2+ messages in thread
From: Hans Verkuil @ 2022-03-21 8:47 UTC (permalink / raw)
To: Linux Media Mailing List
If allocating array_buf fails, or copying data from userspace into that
buffer fails, then just free memory and return the error. Don't attempt
to call video_put_user() since there is no point.
If writing the array back to userspace fails, then don't go to out_array_args,
instead just continue with the regular code that just returns the error
unless 'always_copy' is set. That flag was just completely ignored when
writing back the array data.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
---
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 96e307fe3aab..92433234c430 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -3311,7 +3311,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
array_buf = kvmalloc(array_size, GFP_KERNEL);
err = -ENOMEM;
if (array_buf == NULL)
- goto out_array_args;
+ goto out;
err = -EFAULT;
if (in_compat_syscall())
err = v4l2_compat_get_array_args(file, array_buf,
@@ -3321,7 +3321,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
err = copy_from_user(array_buf, user_ptr, array_size) ?
-EFAULT : 0;
if (err)
- goto out_array_args;
+ goto out;
*kernel_ptr = array_buf;
}
@@ -3353,7 +3353,6 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
} else if (copy_to_user(user_ptr, array_buf, array_size)) {
err = -EFAULT;
}
- goto out_array_args;
}
/*
* Some ioctls can return an error, but still have valid
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH for v5.18] v4l2-ioctl.c: fix incorrect error path
2022-03-21 8:47 [PATCH for v5.18] v4l2-ioctl.c: fix incorrect error path Hans Verkuil
@ 2022-03-21 10:21 ` Hans Verkuil
0 siblings, 0 replies; 2+ messages in thread
From: Hans Verkuil @ 2022-03-21 10:21 UTC (permalink / raw)
To: Linux Media Mailing List
On 21/03/2022 09:47, Hans Verkuil wrote:
> If allocating array_buf fails, or copying data from userspace into that
> buffer fails, then just free memory and return the error. Don't attempt
> to call video_put_user() since there is no point.
>
> If writing the array back to userspace fails, then don't go to out_array_args,
> instead just continue with the regular code that just returns the error
> unless 'always_copy' is set. That flag was just completely ignored when
> writing back the array data.
Ignore this patch, it needs a bit more work.
Hans
>
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
> ---
> diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
> index 96e307fe3aab..92433234c430 100644
> --- a/drivers/media/v4l2-core/v4l2-ioctl.c
> +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
> @@ -3311,7 +3311,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
> array_buf = kvmalloc(array_size, GFP_KERNEL);
> err = -ENOMEM;
> if (array_buf == NULL)
> - goto out_array_args;
> + goto out;
> err = -EFAULT;
> if (in_compat_syscall())
> err = v4l2_compat_get_array_args(file, array_buf,
> @@ -3321,7 +3321,7 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
> err = copy_from_user(array_buf, user_ptr, array_size) ?
> -EFAULT : 0;
> if (err)
> - goto out_array_args;
> + goto out;
> *kernel_ptr = array_buf;
> }
>
> @@ -3353,7 +3353,6 @@ video_usercopy(struct file *file, unsigned int orig_cmd, unsigned long arg,
> } else if (copy_to_user(user_ptr, array_buf, array_size)) {
> err = -EFAULT;
> }
> - goto out_array_args;
> }
> /*
> * Some ioctls can return an error, but still have valid
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-03-21 10:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-21 8:47 [PATCH for v5.18] v4l2-ioctl.c: fix incorrect error path Hans Verkuil
2022-03-21 10:21 ` Hans Verkuil
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.