diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index 55c26e7d370e..e7baa2880eeb 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -38,18 +38,13 @@ * data to the routine. */ -struct v4l2_clip32 { - struct v4l2_rect c; - compat_caddr_t next; -}; - struct v4l2_window32 { struct v4l2_rect w; __u32 field; /* enum v4l2_field */ __u32 chromakey; - compat_caddr_t clips; /* actually struct v4l2_clip32 * */ - __u32 clipcount; - compat_caddr_t bitmap; + compat_caddr_t clips; /* always NULL */ + __u32 clipcount; /* always 0 */ + compat_caddr_t bitmap; /* always NULL */ __u8 global_alpha; }; @@ -65,17 +60,12 @@ static int get_v4l2_window32(struct v4l2_window *p64, .w = w32.w, .field = w32.field, .chromakey = w32.chromakey, - .clips = (void __force *)compat_ptr(w32.clips), - .clipcount = w32.clipcount, - .bitmap = compat_ptr(w32.bitmap), + .clips = NULL, + .clipcount = 0, + .bitmap = NULL, .global_alpha = w32.global_alpha, }; - if (p64->clipcount > 2048) - return -EINVAL; - if (!p64->clipcount) - p64->clips = NULL; - return 0; } @@ -89,16 +79,13 @@ static int put_v4l2_window32(struct v4l2_window *p64, .w = p64->w, .field = p64->field, .chromakey = p64->chromakey, - .clips = (uintptr_t)p64->clips, - .clipcount = p64->clipcount, - .bitmap = ptr_to_compat(p64->bitmap), + .clips = 0, + .clipcount = 0, + .bitmap = 0, .global_alpha = p64->global_alpha, }; - /* copy everything except the clips pointer */ - if (copy_to_user(p32, &w32, offsetof(struct v4l2_window32, clips)) || - copy_to_user(&p32->clipcount, &w32.clipcount, - sizeof(w32) - offsetof(struct v4l2_window32, clipcount))) + if (copy_to_user(p32, &w32, sizeof(w32))) return -EFAULT; return 0; @@ -1043,29 +1030,6 @@ int v4l2_compat_get_array_args(struct file *file, void *mbuf, memset(mbuf, 0, array_size); switch (cmd) { - case VIDIOC_G_FMT32: - case VIDIOC_S_FMT32: - case VIDIOC_TRY_FMT32: { - struct v4l2_format *f64 = arg; - struct v4l2_clip *c64 = mbuf; - struct v4l2_clip32 __user *c32 = user_ptr; - u32 clipcount = f64->fmt.win.clipcount; - - if ((f64->type != V4L2_BUF_TYPE_VIDEO_OVERLAY && - f64->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY) || - clipcount == 0) - return 0; - if (clipcount > 2048) - return -EINVAL; - while (clipcount--) { - if (copy_from_user(c64, c32, sizeof(c64->c))) - return -EFAULT; - c64->next = NULL; - c64++; - c32++; - } - break; - } #ifdef CONFIG_COMPAT_32BIT_TIME case VIDIOC_QUERYBUF32_TIME32: case VIDIOC_QBUF32_TIME32: @@ -1136,28 +1100,6 @@ int v4l2_compat_put_array_args(struct file *file, void __user *user_ptr, int err = 0; switch (cmd) { - case VIDIOC_G_FMT32: - case VIDIOC_S_FMT32: - case VIDIOC_TRY_FMT32: { - struct v4l2_format *f64 = arg; - struct v4l2_clip *c64 = mbuf; - struct v4l2_clip32 __user *c32 = user_ptr; - u32 clipcount = f64->fmt.win.clipcount; - - if ((f64->type != V4L2_BUF_TYPE_VIDEO_OVERLAY && - f64->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY) || - clipcount == 0) - return 0; - if (clipcount > 2048) - return -EINVAL; - while (clipcount--) { - if (copy_to_user(c32, c64, sizeof(c64->c))) - return -EFAULT; - c64++; - c32++; - } - break; - } #ifdef CONFIG_COMPAT_32BIT_TIME case VIDIOC_QUERYBUF32_TIME32: case VIDIOC_QBUF32_TIME32: diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c index 87f163a89c80..2af826f97b4b 100644 --- a/drivers/media/v4l2-core/v4l2-ioctl.c +++ b/drivers/media/v4l2-core/v4l2-ioctl.c @@ -310,14 +310,10 @@ static void v4l_print_format(const void *arg, bool write_only) case V4L2_BUF_TYPE_VIDEO_OVERLAY: case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: win = &p->fmt.win; - /* Note: we can't print the clip list here since the clips - * pointer is a userspace pointer, not a kernelspace - * pointer. */ - pr_cont(", wxh=%dx%d, x,y=%d,%d, field=%s, chromakey=0x%08x, clipcount=%u, clips=%p, bitmap=%p, global_alpha=0x%02x\n", + pr_cont(", wxh=%dx%d, x,y=%d,%d, field=%s, chromakey=0x%08x, global_alpha=0x%02x\n", win->w.width, win->w.height, win->w.left, win->w.top, prt_names(win->field, v4l2_field_names), - win->chromakey, win->clipcount, win->clips, - win->bitmap, win->global_alpha); + win->chromakey, win->global_alpha); break; case V4L2_BUF_TYPE_VBI_CAPTURE: case V4L2_BUF_TYPE_VBI_OUTPUT: @@ -1618,29 +1614,7 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, if (ret) return ret; - /* - * fmt can't be cleared for these overlay types due to the 'clips' - * 'clipcount' and 'bitmap' pointers in struct v4l2_window. - * Those are provided by the user. So handle these two overlay types - * first, and then just do a simple memset for the other types. - */ - switch (p->type) { - case V4L2_BUF_TYPE_VIDEO_OVERLAY: - case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: { - struct v4l2_clip *clips = p->fmt.win.clips; - u32 clipcount = p->fmt.win.clipcount; - void __user *bitmap = p->fmt.win.bitmap; - - memset(&p->fmt, 0, sizeof(p->fmt)); - p->fmt.win.clips = clips; - p->fmt.win.clipcount = clipcount; - p->fmt.win.bitmap = bitmap; - break; - } - default: - memset(&p->fmt, 0, sizeof(p->fmt)); - break; - } + memset(&p->fmt, 0, sizeof(p->fmt)); switch (p->type) { case V4L2_BUF_TYPE_VIDEO_CAPTURE: @@ -1728,6 +1702,9 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, if (unlikely(!ops->vidioc_s_fmt_vid_overlay)) break; memset_after(p, 0, fmt.win); + p->fmt.win.clips = NULL; + p->fmt.win.clipcount = 0; + p->fmt.win.bitmap = NULL; return ops->vidioc_s_fmt_vid_overlay(file, fh, arg); case V4L2_BUF_TYPE_VBI_CAPTURE: if (unlikely(!ops->vidioc_s_fmt_vbi_cap)) @@ -1759,6 +1736,9 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, if (unlikely(!ops->vidioc_s_fmt_vid_out_overlay)) break; memset_after(p, 0, fmt.win); + p->fmt.win.clips = NULL; + p->fmt.win.clipcount = 0; + p->fmt.win.bitmap = NULL; return ops->vidioc_s_fmt_vid_out_overlay(file, fh, arg); case V4L2_BUF_TYPE_VBI_OUTPUT: if (unlikely(!ops->vidioc_s_fmt_vbi_out)) @@ -1830,6 +1810,9 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops, if (unlikely(!ops->vidioc_try_fmt_vid_overlay)) break; memset_after(p, 0, fmt.win); + p->fmt.win.clips = NULL; + p->fmt.win.clipcount = 0; + p->fmt.win.bitmap = NULL; return ops->vidioc_try_fmt_vid_overlay(file, fh, arg); case V4L2_BUF_TYPE_VBI_CAPTURE: if (unlikely(!ops->vidioc_try_fmt_vbi_cap)) @@ -1861,6 +1844,9 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops, if (unlikely(!ops->vidioc_try_fmt_vid_out_overlay)) break; memset_after(p, 0, fmt.win); + p->fmt.win.clips = NULL; + p->fmt.win.clipcount = 0; + p->fmt.win.bitmap = NULL; return ops->vidioc_try_fmt_vid_out_overlay(file, fh, arg); case V4L2_BUF_TYPE_VBI_OUTPUT: if (unlikely(!ops->vidioc_try_fmt_vbi_out)) @@ -3134,27 +3120,6 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size, } break; } - case VIDIOC_G_FMT: - case VIDIOC_S_FMT: - case VIDIOC_TRY_FMT: { - struct v4l2_format *fmt = parg; - - if (fmt->type != V4L2_BUF_TYPE_VIDEO_OVERLAY && - fmt->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY) - break; - if (fmt->fmt.win.clipcount > 2048) - return -EINVAL; - if (!fmt->fmt.win.clipcount) - break; - - *user_ptr = (void __user *)fmt->fmt.win.clips; - *kernel_ptr = (void **)&fmt->fmt.win.clips; - *array_size = sizeof(struct v4l2_clip) - * fmt->fmt.win.clipcount; - - ret = 1; - break; - } case VIDIOC_SUBDEV_G_ROUTING: case VIDIOC_SUBDEV_S_ROUTING: {