Merge tag 'v4.7-rc6' into patchwork

Linux 4.7-rc6

* tag 'v4.7-rc6': (1245 commits)
  Linux 4.7-rc6
  ovl: warn instead of error if d_type is not supported
  MIPS: Fix possible corruption of cache mode by mprotect.
  locks: use file_inode()
  usb: dwc3: st: Use explicit reset_control_get_exclusive() API
  phy: phy-stih407-usb: Use explicit reset_control_get_exclusive() API
  phy: miphy28lp: Inform the reset framework that our reset line may be shared
  namespace: update event counter when umounting a deleted dentry
  9p: use file_dentry()
  lockd: unregister notifier blocks if the service fails to come up completely
  ACPI,PCI,IRQ: correct operator precedence
  fuse: serialize dirops by default
  drm/i915: Fix missing unlock on error in i915_ppgtt_info()
  powerpc: Initialise pci_io_base as early as possible
  mfd: da9053: Fix compiler warning message for uninitialised variable
  mfd: max77620: Fix FPS switch statements
  phy: phy-stih407-usb: Inform the reset framework that our reset line may be shared
  usb: dwc3: st: Inform the reset framework that our reset line may be shared
  usb: host: ehci-st: Inform the reset framework that our reset line may be shared
  usb: host: ohci-st: Inform the reset framework that our reset line may be shared
  ...

1 files changed, 20 insertions, 77 deletions

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index cded5ef52e24..05eed4be25df 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1289,8 +1289,6 @@ struct uvc_xu_control_mapping32 {
 static int uvc_v4l2_get_xu_mapping(struct uvc_xu_control_mapping *kp,
                         const struct uvc_xu_control_mapping32 __user *up)
 {
-        struct uvc_menu_info __user *umenus;
-        struct uvc_menu_info __user *kmenus;
         compat_caddr_t p;
 
         if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
@@ -1307,17 +1305,7 @@ static int uvc_v4l2_get_xu_mapping(struct uvc_xu_control_mapping *kp,
 
         if (__get_user(p, &up->menu_info))
                 return -EFAULT;
-        umenus = compat_ptr(p);
-        if (!access_ok(VERIFY_READ, umenus, kp->menu_count * sizeof(*umenus)))
-                return -EFAULT;
-
-        kmenus = compat_alloc_user_space(kp->menu_count * sizeof(*kmenus));
-        if (kmenus == NULL)
-                return -EFAULT;
-        kp->menu_info = kmenus;
-
-        if (copy_in_user(kmenus, umenus, kp->menu_count * sizeof(*umenus)))
-                return -EFAULT;
+        kp->menu_info = compat_ptr(p);
 
         return 0;
 }
@@ -1325,10 +1313,6 @@ static int uvc_v4l2_get_xu_mapping(struct uvc_xu_control_mapping *kp,
 static int uvc_v4l2_put_xu_mapping(const struct uvc_xu_control_mapping *kp,
                         struct uvc_xu_control_mapping32 __user *up)
 {
-        struct uvc_menu_info __user *umenus;
-        struct uvc_menu_info __user *kmenus = kp->menu_info;
-        compat_caddr_t p;
-
         if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
             __copy_to_user(up, kp, offsetof(typeof(*up), menu_info)) ||
             __put_user(kp->menu_count, &up->menu_count))
@@ -1337,16 +1321,6 @@ static int uvc_v4l2_put_xu_mapping(const struct uvc_xu_control_mapping *kp,
         if (__clear_user(up->reserved, sizeof(up->reserved)))
                 return -EFAULT;
 
-        if (kp->menu_count == 0)
-                return 0;
-
-        if (get_user(p, &up->menu_info))
-                return -EFAULT;
-        umenus = compat_ptr(p);
-
-        if (copy_in_user(umenus, kmenus, kp->menu_count * sizeof(*umenus)))
-                return -EFAULT;
-
         return 0;
 }
 
@@ -1361,8 +1335,6 @@ struct uvc_xu_control_query32 {
 static int uvc_v4l2_get_xu_query(struct uvc_xu_control_query *kp,
                         const struct uvc_xu_control_query32 __user *up)
 {
-        u8 __user *udata;
-        u8 __user *kdata;
         compat_caddr_t p;
 
         if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
@@ -1376,17 +1348,7 @@ static int uvc_v4l2_get_xu_query(struct uvc_xu_control_query *kp,
 
         if (__get_user(p, &up->data))
                 return -EFAULT;
-        udata = compat_ptr(p);
-        if (!access_ok(VERIFY_READ, udata, kp->size))
-                return -EFAULT;
-
-        kdata = compat_alloc_user_space(kp->size);
-        if (kdata == NULL)
-                return -EFAULT;
-        kp->data = kdata;
-
-        if (copy_in_user(kdata, udata, kp->size))
-                return -EFAULT;
+        kp->data = compat_ptr(p);
 
         return 0;
 }
@@ -1394,26 +1356,10 @@ static int uvc_v4l2_get_xu_query(struct uvc_xu_control_query *kp,
 static int uvc_v4l2_put_xu_query(const struct uvc_xu_control_query *kp,
                         struct uvc_xu_control_query32 __user *up)
 {
-        u8 __user *udata;
-        u8 __user *kdata = kp->data;
-        compat_caddr_t p;
-
         if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
             __copy_to_user(up, kp, offsetof(typeof(*up), data)))
                 return -EFAULT;
 
-        if (kp->size == 0)
-                return 0;
-
-        if (get_user(p, &up->data))
-                return -EFAULT;
-        udata = compat_ptr(p);
-        if (!access_ok(VERIFY_READ, udata, kp->size))
-                return -EFAULT;
-
-        if (copy_in_user(udata, kdata, kp->size))
-                return -EFAULT;
-
         return 0;
 }
 
@@ -1423,47 +1369,44 @@ static int uvc_v4l2_put_xu_query(const struct uvc_xu_control_query *kp,
 static long uvc_v4l2_compat_ioctl32(struct file *file,
                      unsigned int cmd, unsigned long arg)
 {
+        struct uvc_fh *handle = file->private_data;
         union {
                 struct uvc_xu_control_mapping xmap;
                 struct uvc_xu_control_query xqry;
         } karg;
         void __user *up = compat_ptr(arg);
-        mm_segment_t old_fs;
         long ret;
 
         switch (cmd) {
         case UVCIOC_CTRL_MAP32:
-                cmd = UVCIOC_CTRL_MAP;
                 ret = uvc_v4l2_get_xu_mapping(&karg.xmap, up);
+                if (ret)
+                        return ret;
+                ret = uvc_ioctl_ctrl_map(handle->chain, &karg.xmap);
+                if (ret)
+                        return ret;
+                ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up);
+                if (ret)
+                        return ret;
+
                 break;
 
         case UVCIOC_CTRL_QUERY32:
-                cmd = UVCIOC_CTRL_QUERY;
                 ret = uvc_v4l2_get_xu_query(&karg.xqry, up);
+                if (ret)
+                        return ret;
+                ret = uvc_xu_ctrl_query(handle->chain, &karg.xqry);
+                if (ret)
+                        return ret;
+                ret = uvc_v4l2_put_xu_query(&karg.xqry, up);
+                if (ret)
+                        return ret;
                 break;
 
         default:
                 return -ENOIOCTLCMD;
         }
 
-        old_fs = get_fs();
-        set_fs(KERNEL_DS);
-        ret = video_ioctl2(file, cmd, (unsigned long)&karg);
-        set_fs(old_fs);
-
-        if (ret < 0)
-                return ret;
-
-        switch (cmd) {
-        case UVCIOC_CTRL_MAP:
-                ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up);
-                break;
-
-        case UVCIOC_CTRL_QUERY:
-                ret = uvc_v4l2_put_xu_query(&karg.xqry, up);
-                break;
-        }
-
         return ret;
 }
 #endif