From: Florian Fainelli <f.fainelli@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org,
Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>,
Mauro Carvalho Chehab <mchehab@s-opensource.com>,
Florian Fainelli <f.fainelli@gmail.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Shuah Khan <shuah@kernel.org>,
Jaedon Shin <jaedon.shin@gmail.com>,
Colin Ian King <colin.king@canonical.com>,
Satendra Singh Thakur <satendra.t@samsung.com>,
linux-media@vger.kernel.org (open list:MEDIA INPUT
INFRASTRUCTURE (V4L/DVB)),
linux-fsdevel@vger.kernel.org (open list:FILESYSTEMS (VFS and
infrastructure))
Subject: [PATCH stable 4.9 20/21] media: dvb_frontend: fix wrong cast in compat_ioctl
Date: Fri, 5 Jun 2020 09:25:17 -0700 [thread overview]
Message-ID: <20200605162518.28099-21-florian.fainelli@broadcom.com> (raw)
In-Reply-To: <20200605162518.28099-1-florian.fainelli@broadcom.com>
From: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
commit 5c6c9c4830b76d851d38829611b3c3e4be0f5cdf upstream
FE_GET_PROPERTY has always failed as following situations:
- Use compatible ioctl
- The array of 'struct dtv_property' has 2 or more items
This patch fixes wrong cast to a pointer 'struct dtv_property' from a
pointer of 2nd or after item of 'struct compat_dtv_property' array.
Signed-off-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
drivers/media/dvb-core/dvb_frontend.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 34f55a2ba071..740dedf03361 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -2081,7 +2081,7 @@ static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd,
}
for (i = 0; i < tvps->num; i++) {
err = dtv_property_process_get(
- fe, &getp, (struct dtv_property *)tvp + i, file);
+ fe, &getp, (struct dtv_property *)(tvp + i), file);
if (err < 0) {
kfree(tvp);
return err;
--
2.17.1
next prev parent reply other threads:[~2020-06-05 16:26 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-05 16:24 [PATCH stable 4.9 00/21] Unbreak 32-bit DVB applications on 64-bit kernels Florian Fainelli
2020-06-05 16:24 ` [PATCH stable 4.9 01/21] media: dvb_frontend: ensure that inital front end status initialized Florian Fainelli
2020-06-05 16:24 ` [PATCH stable 4.9 02/21] media: dvb_frontend: initialize variable s with FE_NONE instead of 0 Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 03/21] media: dvb/frontend.h: move out a private internal structure Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 04/21] media: dvb/frontend.h: document the uAPI file Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 05/21] media: dvb_frontend: get rid of get_property() callback Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 06/21] media: stv0288: get rid of set_property boilerplate Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 07/21] media: stv6110: get rid of a srate dead code Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 08/21] media: friio-fe: get rid of set_property() Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 09/21] media: dvb_frontend: get rid of set_property() callback Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 10/21] media: dvb_frontend: cleanup dvb_frontend_ioctl_properties() Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 11/21] media: dvb_frontend: cleanup ioctl handling logic Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 12/21] media: dvb_frontend: get rid of property cache's state Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 13/21] media: dvb_frontend: better document the -EPERM condition Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 14/21] media: dvb_frontend: fix return values for FE_SET_PROPERTY Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 15/21] media: dvb_frontend: dtv_property_process_set() cleanups Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 16/21] media: dvb_frontend: be sure to init dvb_frontend_handle_ioctl() return code Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 17/21] media: dvb_frontend: Add unlocked_ioctl in dvb_frontend.c Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 18/21] media: dvb_frontend: Add compat_ioctl callback Florian Fainelli
2020-06-05 16:25 ` [PATCH stable 4.9 19/21] media: dvb_frontend: Add commands implementation for compat ioct Florian Fainelli
2020-06-05 16:25 ` Florian Fainelli [this message]
2020-06-05 16:25 ` [PATCH stable 4.9 21/21] media: dvb_frontend: fix return error code Florian Fainelli
2020-06-12 4:45 ` [PATCH stable 4.9 00/21] Unbreak 32-bit DVB applications on 64-bit kernels Florian Fainelli
2020-06-17 4:39 ` Florian Fainelli
2020-06-17 14:21 ` Michael Ira Krufky
2020-06-17 14:22 ` Michael Ira Krufky
2020-06-23 19:13 ` Greg KH
2020-06-24 15:41 ` Florian Fainelli
2020-06-24 16:03 ` Greg KH
2020-06-25 11:30 ` Sean Young
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200605162518.28099-21-florian.fainelli@broadcom.com \
--to=f.fainelli@gmail.com \
--cc=colin.king@canonical.com \
--cc=jaedon.shin@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=mchehab@s-opensource.com \
--cc=mkrufky@linuxtv.org \
--cc=satendra.t@samsung.com \
--cc=shuah@kernel.org \
--cc=stable@vger.kernel.org \
--cc=suzuki.katsuhiro@socionext.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).