evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: fix untrusted pointer for power down setting

Browse source 
When getting power down setting, there is an untrusted pointer
from a user space pointer. Need to copy to the kernel space first.

CRs-Fixed: 2037398
Change-Id: I64032a96e62ddfeec85eebe984d8ba52754f6148
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
This commit is contained in:
VijayaKumar T M 2017-06-15 10:26:19 +05:30 • committed by Gerrit - the friendly Code Review server
parent 085ef3652a
commit c454825fb1
1 changed files with 5 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c
View file

@ -469,17 +469,11 @@ static int32_t msm_sensor_create_pd_settings(void *setting,
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
if (is_compat_task()) { if (is_compat_task()) {
int i = 0; rc = msm_sensor_get_pw_settings_compat(
struct msm_sensor_power_setting32 *power_setting_iter = pd, pu, size_down);
(struct msm_sensor_power_setting32 *)compat_ptr(( if (rc < 0) {
(struct msm_camera_sensor_slave_info32 *)setting)-> pr_err("failed");
power_setting_array.power_setting); return -EFAULT;
for (i = 0; i < size_down; i++) {
pd[i].config_val = power_setting_iter[i].config_val;
pd[i].delay = power_setting_iter[i].delay;
pd[i].seq_type = power_setting_iter[i].seq_type;
pd[i].seq_val = power_setting_iter[i].seq_val;
} }
} else } else
#endif #endif