evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: sensor:validating the flash initialization parameters

Browse source 
Copying the flash initialization parameters from userspace memory to
kernel memory and in turn checking for the validity of the flash
initialization parameters pointer sent from userspace

CRs-Fixed: 2059812
Change-Id: I957c10959108eb08b263d439a9a449b90338b6db
Signed-off-by: kaiwang <kaiwang@codeaurora.org>
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
This commit is contained in:
kaiwang 2017-06-29 16:12:59 +08:00 • committed by Gerrit - the friendly Code Review server
parent 502914e130
commit 379e41427b
1 changed files with 35 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c
View file

@ -508,18 +508,42 @@ static int32_t msm_flash_init(
return 0; return 0;
} }
static int32_t msm_flash_init_prepare(
struct msm_flash_ctrl_t *flash_ctrl,
struct msm_flash_cfg_data_t *flash_data)
{
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
static int32_t msm_flash_init_prepare( struct msm_flash_cfg_data_t flash_data_k;
struct msm_flash_ctrl_t *flash_ctrl, struct msm_flash_init_info_t flash_init_info;
struct msm_flash_cfg_data_t *flash_data) int32_t i = 0;
{
if (!is_compat_task()) {
/*for 64-bit usecase,it need copy the data to local memory*/
flash_data_k.cfg_type = flash_data->cfg_type;
for (i = 0; i < MAX_LED_TRIGGERS; i++) {
flash_data_k.flash_current[i] =
flash_data->flash_current[i];
flash_data_k.flash_duration[i] =
flash_data->flash_duration[i];
}
flash_data_k.cfg.flash_init_info = &flash_init_info;
if (copy_from_user(&flash_init_info,
(void __user *)(flash_data->cfg.flash_init_info),
sizeof(struct msm_flash_init_info_t))) {
pr_err("%s copy_from_user failed %d\n",
__func__, __LINE__);
return -EFAULT;
}
return msm_flash_init(flash_ctrl, &flash_data_k);
}
/*
* for 32-bit usecase,it already copy the userspace
* data to local memory in msm_flash_subdev_do_ioctl()
* so here do not need copy from user
*/
return msm_flash_init(flash_ctrl, flash_data); return msm_flash_init(flash_ctrl, flash_data);
}
#else #else
static int32_t msm_flash_init_prepare(
struct msm_flash_ctrl_t *flash_ctrl,
struct msm_flash_cfg_data_t *flash_data)
{
struct msm_flash_cfg_data_t flash_data_k; struct msm_flash_cfg_data_t flash_data_k;
struct msm_flash_init_info_t flash_init_info; struct msm_flash_init_info_t flash_init_info;
int32_t i = 0; int32_t i = 0;
@ -534,15 +558,15 @@ static int32_t msm_flash_init_prepare(
flash_data_k.cfg.flash_init_info = &flash_init_info; flash_data_k.cfg.flash_init_info = &flash_init_info;
if (copy_from_user(&flash_init_info, if (copy_from_user(&flash_init_info,
(void *)(flash_data->cfg.flash_init_info), (void __user *)(flash_data->cfg.flash_init_info),
sizeof(struct msm_flash_init_info_t))) { sizeof(struct msm_flash_init_info_t))) {
pr_err("%s copy_from_user failed %d\n", pr_err("%s copy_from_user failed %d\n",
__func__, __LINE__); __func__, __LINE__);
return -EFAULT; return -EFAULT;
} }
return msm_flash_init(flash_ctrl, &flash_data_k); return msm_flash_init(flash_ctrl, &flash_data_k);
}
#endif #endif
}
static int32_t msm_flash_prepare( static int32_t msm_flash_prepare(
struct msm_flash_ctrl_t *flash_ctrl) struct msm_flash_ctrl_t *flash_ctrl)