diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c index b0a6cb9ce0aa..a2fb3ada95bc 100644 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c @@ -871,17 +871,17 @@ static int put_v4l2_ext_controls32(struct file *file, u32 n; compat_caddr_t p; -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ assign_in_user(&up->ctrl_class, &kp->ctrl_class) || -+ get_user(count, &kp->count) || -+ put_user(count, &up->count) || -+ assign_in_user(&up->error_idx, &kp->error_idx) || -+ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)) || -+ get_user(kcontrols, &kp->controls)) -+ return -EFAULT; + if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || + assign_in_user(&up->ctrl_class, &kp->ctrl_class) || + get_user(count, &kp->count) || + put_user(count, &up->count) || + assign_in_user(&up->error_idx, &kp->error_idx) || + copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)) || + get_user(kcontrols, &kp->controls)) + return -EFAULT; -+ if (!count) -+ return 0; + if (!count) + return 0; if (get_user(p, &up->controls)) return -EFAULT;