Skip to contentSkip to conversation

Patch "media: v4l2-compat-ioctl32: Fix timespec conversion" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Sep 22, 2017

Subsystems (2)
Stable branch Media (V4L/DVB)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

media: v4l2-compat-ioctl32: Fix timespec conversion

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
media-v4l2-compat-ioctl32-fix-timespec-conversion.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 9c7ba1d7634cef490b85bc64c4091ff004821bfd Mon Sep 17 00:00:00 2001

From: Daniel Mentz <[email protected]>
Date: Wed, 2 Aug 2017 23:42:17 -0400
Subject: media: v4l2-compat-ioctl32: Fix timespec conversion

From: Daniel Mentz <[email protected]>

commit 9c7ba1d7634cef490b85bc64c4091ff004821bfd upstream.

Certain syscalls like recvmmsg support 64 bit timespec values for the X32 ABI. The helper function compat_put_timespec converts a timespec value to a 32 bit or 64 bit value depending on what ABI is used. The v4l2 compat layer, however, is not designed to support 64 bit timespec values and always uses 32 bit values. Hence, compat_put_timespec must not be used.

Without this patch, user space will be provided with bad timestamp values from the VIDIOC_DQEVENT ioctl. Also, fields of the struct v4l2_event32 that come immediately after timestamp get overwritten, namely the field named id.

Fixes 81993e81a994 ("compat: Get rid of (get|put)_compat_time(val|spec)")
Cc H. Peter Anvin <[email protected]>
Cc Laurent Pinchart <[email protected]>
Cc Tiffany Lin <[email protected]>
Cc Ricardo Ribalda Delgado <[email protected]>
Cc Sakari Ailus <[email protected]>
Signed-off-by Daniel Mentz <[email protected]>
Signed-off-by Hans Verkuil <[email protected]>
Signed-off-by Mauro Carvalho Chehab <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/v4l2-core/v4l2-compat-ioctl32.c +2 -1
@@ -773,7 +773,8 @@ static int put_v4l2_event32(struct v4l2_
 		copy_to_user(&up->u, &kp->u, sizeof(kp->u)) ||
 		put_user(kp->pending, &up->pending) ||
 		put_user(kp->sequence, &up->sequence) ||
-		compat_put_timespec(&kp->timestamp, &up->timestamp) ||
+		put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) ||
+		put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) ||
 		put_user(kp->id, &up->id) ||
 		copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32)))
 			return -EFAULT;

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/media-v4l2-compat-ioctl32-fix-timespec-conversion.patch