evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: Fix for OOB security CR

Browse source 
If user passes an aribitary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should point to any arbitrary address.

Check for invalid command and return error.

Change-Id: If60191a07bb80939af2d471a5acf1b17dd68aa58
CRs-Fixed: 2299567
Signed-off-by: Abhishek Abbanaveni <aabban@codeaurora.org>
This commit is contained in:
Abhishek Abbanaveni 2018-11-20 14:57:06 +05:30 • committed by Gerrit - the friendly Code Review server
parent 088a3bfea3
commit 3a1e5f4ce9
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2016-2018 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -324,10 +324,6 @@ static long msm_ir_led_subdev_do_ioctl(
struct msm_ir_led_cfg_data_t ir_led_data;
CDBG("Enter\n");
ir_led_data.cfg_type = u32->cfg_type;
ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns;
ir_led_data.pwm_period_ns = u32->pwm_period_ns;
switch (cmd) {
case VIDIOC_MSM_IR_LED_CFG32:
cmd = VIDIOC_MSM_IR_LED_CFG;
@ -336,6 +332,10 @@ static long msm_ir_led_subdev_do_ioctl(
return msm_ir_led_subdev_ioctl(sd, cmd, arg);
}
ir_led_data.cfg_type = u32->cfg_type;
ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns;
ir_led_data.pwm_period_ns = u32->pwm_period_ns;
rc = msm_ir_led_subdev_ioctl(sd, cmd, &ir_led_data);
CDBG("Exit\n");