1 files changed, 18 insertions, 0 deletions

diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
index 83ffb6436baf..cc5998b31463 100644
--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
@@ -297,6 +297,7 @@ struct v4l2_plane32 {
         union {
                 __u32           mem_offset;
                 compat_long_t   userptr;
+                __s32           fd;
         } m;
         __u32                   data_offset;
         __u32                   reserved[11];
@@ -318,6 +319,7 @@ struct v4l2_buffer32 {
                 __u32           offset;
                 compat_long_t   userptr;
                 compat_caddr_t  planes;
+                __s32           fd;
         } m;
         __u32                   length;
         __u32                   reserved2;
@@ -341,6 +343,9 @@ static int get_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
                 up_pln = compat_ptr(p);
                 if (put_user((unsigned long)up_pln, &up->m.userptr))
                         return -EFAULT;
+        } else if (memory == V4L2_MEMORY_DMABUF) {
+                if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(int)))
+                        return -EFAULT;
         } else {
                 if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset,
                                         sizeof(__u32)))
@@ -364,6 +369,11 @@ static int put_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
                 if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset,
                                         sizeof(__u32)))
                         return -EFAULT;
+        /* For DMABUF, driver might've set up the fd, so copy it back. */
+        if (memory == V4L2_MEMORY_DMABUF)
+                if (copy_in_user(&up32->m.fd, &up->m.fd,
+                                        sizeof(int)))
+                        return -EFAULT;
 
         return 0;
 }
@@ -446,6 +456,10 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
                         if (get_user(kp->m.offset, &up->m.offset))
                                 return -EFAULT;
                         break;
+                case V4L2_MEMORY_DMABUF:
+                        if (get_user(kp->m.fd, &up->m.fd))
+                                return -EFAULT;
+                        break;
                 }
         }
 
@@ -510,6 +524,10 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
                         if (put_user(kp->m.offset, &up->m.offset))
                                 return -EFAULT;
                         break;
+                case V4L2_MEMORY_DMABUF:
+                        if (put_user(kp->m.fd, &up->m.fd))
+                                return -EFAULT;
+                        break;
                 }
         }