[media] ivtv: Return EFAULT when copy_from_user() fails in ivtv_write_vbi_from_user()

If write() on a VBI device node fails due to a bad buffer pointer from
userspace, we should notify the application properly with EFAULT, per the
V4L2 API spec.

Signed-off-by: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

3 files changed, 15 insertions, 9 deletions

diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c
index 4f46b0070806..c57a58523ca8 100644
--- a/drivers/media/video/ivtv/ivtv-fileops.c
+++ b/drivers/media/video/ivtv/ivtv-fileops.c
@@ -570,9 +570,8 @@ ssize_t ivtv_v4l2_write(struct file *filp, const char __user *user_buf, size_t c
 		int elems = count / sizeof(struct v4l2_sliced_vbi_data);
 
 		set_bit(IVTV_F_S_APPL_IO, &s->s_flags);
-		ivtv_write_vbi_from_user(itv,
+		return ivtv_write_vbi_from_user(itv,
 		   (const struct v4l2_sliced_vbi_data __user *)user_buf, elems);
-		return elems * sizeof(struct v4l2_sliced_vbi_data);
 	}
 
 	mode = s->type == IVTV_DEC_STREAM_TYPE_MPG ? OUT_MPG : OUT_YUV;
diff --git a/drivers/media/video/ivtv/ivtv-vbi.c b/drivers/media/video/ivtv/ivtv-vbi.c
index 7275f2d6597e..2dfa957b0fd5 100644
--- a/drivers/media/video/ivtv/ivtv-vbi.c
+++ b/drivers/media/video/ivtv/ivtv-vbi.c
@@ -157,24 +157,30 @@ static void ivtv_write_vbi(struct ivtv *itv,
 		ivtv_write_vbi_cc_lines(itv, &cc);
 }
 
-void ivtv_write_vbi_from_user(struct ivtv *itv,
-			      const struct v4l2_sliced_vbi_data __user *sliced,
-			      size_t cnt)
+ssize_t
+ivtv_write_vbi_from_user(struct ivtv *itv,
+			 const struct v4l2_sliced_vbi_data __user *sliced,
+			 size_t cnt)
 {
 	struct vbi_cc cc = { .odd = { 0x80, 0x80 }, .even = { 0x80, 0x80 } };
 	int found_cc = 0;
 	size_t i;
 	struct v4l2_sliced_vbi_data d;
+	ssize_t ret = cnt * sizeof(struct v4l2_sliced_vbi_data);
 
 	for (i = 0; i < cnt; i++) {
 		if (copy_from_user(&d, sliced + i,
-				   sizeof(struct v4l2_sliced_vbi_data)))
+				   sizeof(struct v4l2_sliced_vbi_data))) {
+			ret = -EFAULT;
 			break;
+		}
 		ivtv_write_vbi_line(itv, sliced + i, &cc, &found_cc);
 	}
 
 	if (found_cc)
 		ivtv_write_vbi_cc_lines(itv, &cc);
+
+	return ret;
 }
 
 static void copy_vbi_data(struct ivtv *itv, int lines, u32 pts_stamp)
diff --git a/drivers/media/video/ivtv/ivtv-vbi.h b/drivers/media/video/ivtv/ivtv-vbi.h
index eda38d0ad7ce..166dd0b75d0f 100644
--- a/drivers/media/video/ivtv/ivtv-vbi.h
+++ b/drivers/media/video/ivtv/ivtv-vbi.h
@@ -20,9 +20,10 @@
 #ifndef IVTV_VBI_H
 #define IVTV_VBI_H
 
-void ivtv_write_vbi_from_user(struct ivtv *itv,
-			      const struct v4l2_sliced_vbi_data __user *sliced,
-			      size_t count);
+ssize_t
+ivtv_write_vbi_from_user(struct ivtv *itv,
+			 const struct v4l2_sliced_vbi_data __user *sliced,
+			 size_t count);
 void ivtv_process_vbi_data(struct ivtv *itv, struct ivtv_buffer *buf,
 			   u64 pts_stamp, int streamtype);
 int ivtv_used_line(struct ivtv *itv, int line, int field);