From c445340edc2cdefd5f9dd21e67442dd05db36192 Mon Sep 17 00:00:00 2001 From: Sureshnaidu Laveti Date: Tue, 20 Dec 2016 03:41:53 -0800 Subject: [PATCH] msm: sensor: validating the flash initialization parameters Copying the flash initialization parameters from userspace memory to kernel memory and in turn checking for the validity of the flash initialization parameters pointer sent from userspace. CRs-Fixed: 1091603 Change-Id: I17d57016c254fb6628844a152b0e7d45c0b23b2d Signed-off-by: Sureshnaidu Laveti --- .../msm/camera_v2/sensor/flash/msm_flash.c | 38 ++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c index 800b2932854d..5376e1e4b6a4 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c +++ b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c @@ -502,6 +502,42 @@ static int32_t msm_flash_init( return 0; } +#ifdef CONFIG_COMPAT +static int32_t msm_flash_init_prepare( + struct msm_flash_ctrl_t *flash_ctrl, + struct msm_flash_cfg_data_t *flash_data) +{ + return msm_flash_init(flash_ctrl, flash_data); +} +#else +static int32_t msm_flash_init_prepare( + struct msm_flash_ctrl_t *flash_ctrl, + struct msm_flash_cfg_data_t *flash_data) +{ + struct msm_flash_cfg_data_t flash_data_k; + struct msm_flash_init_info_t flash_init_info; + int32_t i = 0; + + flash_data_k.cfg_type = flash_data->cfg_type; + for (i = 0; i < MAX_LED_TRIGGERS; i++) { + flash_data_k.flash_current[i] = + flash_data->flash_current[i]; + flash_data_k.flash_duration[i] = + flash_data->flash_duration[i]; + } + + flash_data_k.cfg.flash_init_info = &flash_init_info; + if (copy_from_user(&flash_init_info, + (void *)(flash_data->cfg.flash_init_info), + sizeof(struct msm_flash_init_info_t))) { + pr_err("%s copy_from_user failed %d\n", + __func__, __LINE__); + return -EFAULT; + } + return msm_flash_init(flash_ctrl, &flash_data_k); +} +#endif + static int32_t msm_flash_prepare( struct msm_flash_ctrl_t *flash_ctrl) { @@ -665,7 +701,7 @@ static int32_t msm_flash_config(struct msm_flash_ctrl_t *flash_ctrl, switch (flash_data->cfg_type) { case CFG_FLASH_INIT: - rc = msm_flash_init(flash_ctrl, flash_data); + rc = msm_flash_init_prepare(flash_ctrl, flash_data); break; case CFG_FLASH_RELEASE: if (flash_ctrl->flash_state != MSM_CAMERA_FLASH_RELEASE) {