1 files changed, 10 insertions, 1 deletions

diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 997975d5e024..f77f84bfe714 100644
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -288,7 +288,7 @@ static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
 
 static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
 {
-        if (copy_to_user(&up->w, &kp->w, sizeof(up->w)) ||
+        if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) ||
                 put_user(kp->field, &up->field) ||
                 put_user(kp->chromakey, &up->chromakey) ||
                 put_user(kp->clipcount, &up->clipcount))
@@ -475,6 +475,9 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
                         return -EFAULT;
         switch (kp->memory) {
         case V4L2_MEMORY_MMAP:
+                if (get_user(kp->length, &up->length) ||
+                        get_user(kp->m.offset, &up->m.offset))
+                        return -EFAULT;
                 break;
         case V4L2_MEMORY_USERPTR:
                 {
@@ -1077,6 +1080,12 @@ long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOC_DBG_G_REGISTER:
         case VIDIOC_DBG_G_CHIP_IDENT:
         case VIDIOC_S_HW_FREQ_SEEK:
+        case VIDIOC_ENUM_DV_PRESETS:
+        case VIDIOC_S_DV_PRESET:
+        case VIDIOC_G_DV_PRESET:
+        case VIDIOC_QUERY_DV_PRESET:
+        case VIDIOC_S_DV_TIMINGS:
+        case VIDIOC_G_DV_TIMINGS:
                 ret = do_video_ioctl(file, cmd, arg);
                 break;