evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ais: cpp changes to validate ioctl input

Browse source 
When the Camera application exercises the  V4L2  ioctl operations, CPP
driver would attempt to the copy  user space buffer  contents into the
internal kernel buffer.  If an invalid length of the user space buffer
is passed onto the driver, it could trigger buffer overflow condition.
Thus, fix this by copying user space buffer contents into kernel space
buffer of the  driver for further processing, only after checking for
proper length of user space buffer.

Change-Id: I0386d0f84a8d7015bfe6bbb1e9472fa8934df83a
CRs-Fixed: 2025367
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
This commit is contained in:
Rahul Sharma 2017-07-07 14:11:37 +05:30 • committed by Gerrit - the friendly Code Review server
parent 8a9f65f16a
commit 22ec4f5399
1 changed files with 13 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
drivers/media/platform/msm/ais/pproc/cpp/msm_cpp.c
View file

@ -2882,7 +2882,7 @@ end:
return rc;
}
static int msm_cpp_validate_input(unsigned int cmd, void *arg,
static int msm_cpp_validate_ioctl_input(unsigned int cmd, void *arg,
struct msm_camera_v4l2_ioctl_t **ioctl_ptr)
{
switch (cmd) {
@ -2922,6 +2922,14 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
pr_err("sd %pK\n", sd);
return -EINVAL;
}
rc = msm_cpp_validate_ioctl_input(cmd, arg, &ioctl_ptr);
if (rc != 0) {
pr_err("input validation failed\n");
return rc;
}
cpp_dev = v4l2_get_subdevdata(sd);
if (cpp_dev == NULL) {
pr_err("cpp_dev is null\n");
@ -2933,11 +2941,6 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
return -EINVAL;
}
rc = msm_cpp_validate_input(cmd, arg, &ioctl_ptr);
if (rc != 0) {
pr_err("input validation failed\n");
return rc;
}
mutex_lock(&cpp_dev->mutex);
CPP_DBG("E cmd: 0x%x\n", cmd);
@ -3437,6 +3440,7 @@ STREAM_BUFF_END:
} else {
pr_err("%s:%d IOMMMU attach triggered in invalid state\n",
__func__, __LINE__);
rc = -EINVAL;
}
break;
}
@ -4061,7 +4065,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
default:
pr_err_ratelimited("%s: unsupported compat type :%x LOAD %lu\n",
__func__, cmd, VIDIOC_MSM_CPP_LOAD_FIRMWARE);
break;
mutex_unlock(&cpp_dev->mutex);
return -EINVAL;
}
mutex_unlock(&cpp_dev->mutex);
@ -4092,7 +4097,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
default:
pr_err_ratelimited("%s: unsupported compat type :%d\n",
__func__, cmd);
break;
return -EINVAL;
}
if (is_copytouser_req) {