From: Hans Verkuil Date: Tue, 10 Jun 2014 10:07:38 +0000 (-0300) Subject: [media] v4l2-ctrl: fix error return of copy_to/from_user X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=40265bbe42933920684136ff759e6340eaf72774;p=openwrt%2Fstaging%2Fblogic.git [media] v4l2-ctrl: fix error return of copy_to/from_user copy_to/from_user returns the number of bytes not copied, it does not return a 'normal' linux error code. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c index e6e33b3110fa..1086ae3f9152 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls.c +++ b/drivers/media/v4l2-core/v4l2-ctrls.c @@ -1326,7 +1326,8 @@ static int ptr_to_user(struct v4l2_ext_control *c, u32 len; if (ctrl->is_ptr && !ctrl->is_string) - return copy_to_user(c->ptr, ptr.p, c->size); + return copy_to_user(c->ptr, ptr.p, c->size) ? + -EFAULT : 0; switch (ctrl->type) { case V4L2_CTRL_TYPE_STRING: @@ -1336,7 +1337,7 @@ static int ptr_to_user(struct v4l2_ext_control *c, return -ENOSPC; } return copy_to_user(c->string, ptr.p_char, len + 1) ? - -EFAULT : 0; + -EFAULT : 0; case V4L2_CTRL_TYPE_INTEGER64: c->value64 = *ptr.p_s64; break; @@ -1373,7 +1374,7 @@ static int user_to_ptr(struct v4l2_ext_control *c, if (ctrl->is_ptr && !ctrl->is_string) { unsigned idx; - ret = copy_from_user(ptr.p, c->ptr, c->size); + ret = copy_from_user(ptr.p, c->ptr, c->size) ? -EFAULT : 0; if (ret || !ctrl->is_array) return ret; for (idx = c->size / ctrl->elem_size; idx < ctrl->elems; idx++) @@ -1391,7 +1392,7 @@ static int user_to_ptr(struct v4l2_ext_control *c, return -ERANGE; if (size > ctrl->maximum + 1) size = ctrl->maximum + 1; - ret = copy_from_user(ptr.p_char, c->string, size); + ret = copy_from_user(ptr.p_char, c->string, size) ? -EFAULT : 0; if (!ret) { char last = ptr.p_char[size - 1]; @@ -1401,7 +1402,7 @@ static int user_to_ptr(struct v4l2_ext_control *c, if (strlen(ptr.p_char) == ctrl->maximum && last) return -ERANGE; } - return ret ? -EFAULT : 0; + return ret; default: *ptr.p_s32 = c->value; break;