media: v4l2-ioctl.c: don't copy back the result for -ENOTTY

commit 181a4a2d5a0a7b43cab08a70710d727e7764ccdd upstream.

If the ioctl returned -ENOTTY, then don't bother copying
back the result as there is no point.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: <stable@vger.kernel.org>      # for v4.15 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[sw0312.kim: cherry-pick from linux-3.18.y to apply CVE patch]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I74f89733fb3be9adb9ba8026be1dc699bed0445f

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 9ccb19a435ef7a04a7d125af5a5b86c3b130a79d..bb2387fcbfee9480f6d47ba79899f66c1e42a05e 100644 (file)
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2539,8 +2539,11 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
 
        /* Handles IOCTL */
        err = func(file, cmd, parg);
-       if (err == -ENOIOCTLCMD)
+       if (err == -ENOTTY || err == -ENOIOCTLCMD) {
                err = -ENOTTY;
+               goto out;
+       }
+
        if (err == 0) {
                if (cmd == VIDIOC_DQBUF)
                        trace_v4l2_dqbuf(video_devdata(file)->minor, parg);