From: Hans Verkuil <hans.verkuil@cisco.com>
Date: Wed, 29 May 2013 10:00:08 +0000 (-0300)
Subject: upstream: [media] cx18: fix register range check
X-Git-Tag: submit/tizen/20141121.110247~2208
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=491050019aaeecbdf3f09cd8aa4f787438313ce3;p=platform%2Fkernel%2Flinux-3.10.git

upstream: [media] cx18: fix register range check

Ensure that the register is aligned to a dword, otherwise the range check
could fail since it assumes dword alignment.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: Andy Walls <awalls@md.metrocast.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

diff --git a/drivers/media/pci/cx18/cx18-ioctl.c b/drivers/media/pci/cx18/cx18-ioctl.c
index 414b0ec..1110bcb 100644
--- a/drivers/media/pci/cx18/cx18-ioctl.c
+++ b/drivers/media/pci/cx18/cx18-ioctl.c
@@ -367,6 +367,8 @@ static int cx18_g_register(struct file *file, void *fh,
 {
 	struct cx18 *cx = fh2id(fh)->cx;
 
+	if (reg->reg & 0x3)
+		return -EINVAL;
 	if (reg->reg >= CX18_MEM_OFFSET + CX18_MEM_SIZE)
 		return -EINVAL;
 	reg->size = 4;
@@ -379,6 +381,8 @@ static int cx18_s_register(struct file *file, void *fh,
 {
 	struct cx18 *cx = fh2id(fh)->cx;
 
+	if (reg->reg & 0x3)
+		return -EINVAL;
 	if (reg->reg >= CX18_MEM_OFFSET + CX18_MEM_SIZE)
 		return -EINVAL;
 	cx18_write_enc(cx, reg->val, reg->reg);