aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/media/v4l2-core/v4l2-ioctl.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index d9113cc71c77..f729bd26f6fc 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2260,7 +2260,7 @@ done:
2260} 2260}
2261 2261
2262static int check_array_args(unsigned int cmd, void *parg, size_t *array_size, 2262static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
2263 void * __user *user_ptr, void ***kernel_ptr) 2263 void __user **user_ptr, void ***kernel_ptr)
2264{ 2264{
2265 int ret = 0; 2265 int ret = 0;
2266 2266
@@ -2277,7 +2277,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
2277 break; 2277 break;
2278 } 2278 }
2279 *user_ptr = (void __user *)buf->m.planes; 2279 *user_ptr = (void __user *)buf->m.planes;
2280 *kernel_ptr = (void *)&buf->m.planes; 2280 *kernel_ptr = (void **)&buf->m.planes;
2281 *array_size = sizeof(struct v4l2_plane) * buf->length; 2281 *array_size = sizeof(struct v4l2_plane) * buf->length;
2282 ret = 1; 2282 ret = 1;
2283 } 2283 }
@@ -2294,7 +2294,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
2294 break; 2294 break;
2295 } 2295 }
2296 *user_ptr = (void __user *)edid->edid; 2296 *user_ptr = (void __user *)edid->edid;
2297 *kernel_ptr = (void *)&edid->edid; 2297 *kernel_ptr = (void **)&edid->edid;
2298 *array_size = edid->blocks * 128; 2298 *array_size = edid->blocks * 128;
2299 ret = 1; 2299 ret = 1;
2300 } 2300 }
@@ -2312,7 +2312,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
2312 break; 2312 break;
2313 } 2313 }
2314 *user_ptr = (void __user *)ctrls->controls; 2314 *user_ptr = (void __user *)ctrls->controls;
2315 *kernel_ptr = (void *)&ctrls->controls; 2315 *kernel_ptr = (void **)&ctrls->controls;
2316 *array_size = sizeof(struct v4l2_ext_control) 2316 *array_size = sizeof(struct v4l2_ext_control)
2317 * ctrls->count; 2317 * ctrls->count;
2318 ret = 1; 2318 ret = 1;
@@ -2412,7 +2412,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
2412 } 2412 }
2413 2413
2414 if (has_array_args) { 2414 if (has_array_args) {
2415 *kernel_ptr = user_ptr; 2415 *kernel_ptr = (void __force *)user_ptr;
2416 if (copy_to_user(user_ptr, mbuf, array_size)) 2416 if (copy_to_user(user_ptr, mbuf, array_size))
2417 err = -EFAULT; 2417 err = -EFAULT;
2418 goto out_array_args; 2418 goto out_array_args;