1 files changed, 14 insertions, 5 deletions

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 7e2411c36419..cca6c2f76b3a 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -540,7 +540,16 @@ struct v4l2_framebuffer32 {
         __u32                   capability;
         __u32                   flags;
         compat_caddr_t          base;
-        struct v4l2_pix_format  fmt;
+        struct {
+                __u32           width;
+                __u32           height;
+                __u32           pixelformat;
+                __u32           field;
+                __u32           bytesperline;
+                __u32           sizeimage;
+                __u32           colorspace;
+                __u32           priv;
+        } fmt;
 };
 
 static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_framebuffer32 __user *up)
@@ -550,10 +559,10 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
         if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_framebuffer32)) ||
                 get_user(tmp, &up->base) ||
                 get_user(kp->capability, &up->capability) ||
-                get_user(kp->flags, &up->flags))
+                get_user(kp->flags, &up->flags) ||
+                copy_from_user(&kp->fmt, &up->fmt, sizeof(up->fmt)))
                         return -EFAULT;
         kp->base = compat_ptr(tmp);
-        get_v4l2_pix_format(&kp->fmt, &up->fmt);
         return 0;
 }
 
@@ -564,9 +573,9 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
         if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_framebuffer32)) ||
                 put_user(tmp, &up->base) ||
                 put_user(kp->capability, &up->capability) ||
-                put_user(kp->flags, &up->flags))
+                put_user(kp->flags, &up->flags) ||
+                copy_to_user(&up->fmt, &kp->fmt, sizeof(up->fmt)))
                         return -EFAULT;
-        put_v4l2_pix_format(&kp->fmt, &up->fmt);
         return 0;
 }