[media] v4l2-ioctl: don't set PRIV_MAGIC unconditionally in g_fmt()

Regression fix:

V4L2_PIX_FMT_PRIV_MAGIC should only be set for the VIDEO_CAPTURE and
VIDEO_OUTPUT buffer types, and not for any others. In the case of
the win format this overwrote a pointer value that is passed in from
userspace.

Just set it for V4L2_BUF_TYPE_VIDEO_CAPTURE and OUTPUT only. Set
it before the callback is called, just as is done for try/s_fmt, and
again afterwards in case the driver zeroed it. The latter was missing
in try/s_fmt, so add it there as well. Currently it is quite likely
that drivers clear priv (that was needed for a long time), so it makes
sense to set it twice.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 00ceedf16bb70a07c94ac442433a113916c738cc..d15e16737eef4e0fd6d58d9babcba00ddcd2df77 100644 (file)
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -1144,8 +1144,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
        bool is_tx = vfd->vfl_dir != VFL_DIR_RX;
        int ret;
 
-       p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
-
        /*
         * fmt can't be cleared for these overlay types due to the 'clips'
         * 'clipcount' and 'bitmap' pointers in struct v4l2_window.
@@ -1174,7 +1172,9 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
        case V4L2_BUF_TYPE_VIDEO_CAPTURE:
                if (unlikely(!is_rx || !is_vid || !ops->vidioc_g_fmt_vid_cap))
                        break;
+               p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
                ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg);
+               /* just in case the driver zeroed it again */
                p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
                return ret;
        case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
@@ -1196,7 +1196,9 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
        case V4L2_BUF_TYPE_VIDEO_OUTPUT:
                if (unlikely(!is_tx || !is_vid || !ops->vidioc_g_fmt_vid_out))
                        break;
+               p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
                ret = ops->vidioc_g_fmt_vid_out(file, fh, arg);
+               /* just in case the driver zeroed it again */
                p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
                return ret;
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
@@ -1232,6 +1234,7 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
        bool is_sdr = vfd->vfl_type == VFL_TYPE_SDR;
        bool is_rx = vfd->vfl_dir != VFL_DIR_TX;
        bool is_tx = vfd->vfl_dir != VFL_DIR_RX;
+       int ret;
 
        v4l_sanitize_format(p);
 
@@ -1240,7 +1243,10 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!is_rx || !is_vid || !ops->vidioc_s_fmt_vid_cap))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix);
-               return ops->vidioc_s_fmt_vid_cap(file, fh, arg);
+               ret = ops->vidioc_s_fmt_vid_cap(file, fh, arg);
+               /* just in case the driver zeroed it again */
+               p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
+               return ret;
        case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
                if (unlikely(!is_rx || !is_vid || !ops->vidioc_s_fmt_vid_cap_mplane))
                        break;
@@ -1265,7 +1271,10 @@ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!is_tx || !is_vid || !ops->vidioc_s_fmt_vid_out))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix);
-               return ops->vidioc_s_fmt_vid_out(file, fh, arg);
+               ret = ops->vidioc_s_fmt_vid_out(file, fh, arg);
+               /* just in case the driver zeroed it again */
+               p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
+               return ret;
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
                if (unlikely(!is_tx || !is_vid || !ops->vidioc_s_fmt_vid_out_mplane))
                        break;
@@ -1304,6 +1313,7 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
        bool is_sdr = vfd->vfl_type == VFL_TYPE_SDR;
        bool is_rx = vfd->vfl_dir != VFL_DIR_TX;
        bool is_tx = vfd->vfl_dir != VFL_DIR_RX;
+       int ret;
 
        v4l_sanitize_format(p);
 
@@ -1312,7 +1322,10 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!is_rx || !is_vid || !ops->vidioc_try_fmt_vid_cap))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix);
-               return ops->vidioc_try_fmt_vid_cap(file, fh, arg);
+               ret = ops->vidioc_try_fmt_vid_cap(file, fh, arg);
+               /* just in case the driver zeroed it again */
+               p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
+               return ret;
        case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
                if (unlikely(!is_rx || !is_vid || !ops->vidioc_try_fmt_vid_cap_mplane))
                        break;
@@ -1337,7 +1350,10 @@ static int v4l_try_fmt(const struct v4l2_ioctl_ops *ops,
                if (unlikely(!is_tx || !is_vid || !ops->vidioc_try_fmt_vid_out))
                        break;
                CLEAR_AFTER_FIELD(p, fmt.pix);
-               return ops->vidioc_try_fmt_vid_out(file, fh, arg);
+               ret = ops->vidioc_try_fmt_vid_out(file, fh, arg);
+               /* just in case the driver zeroed it again */
+               p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
+               return ret;
        case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE:
                if (unlikely(!is_tx || !is_vid || !ops->vidioc_try_fmt_vid_out_mplane))
                        break;