From f4cc27b8cdbfab08f9907cf26f7f97f8fd456ea6 Mon Sep 17 00:00:00 2001 From: E V Ravi Date: Tue, 18 Dec 2018 14:41:59 +0530 Subject: [PATCH] msm: ais: Fix for OOB security CR If the user passes the arbitrary command with _IOC_DIR(cmd) == _IOC_NONE, "arg" should point to any arbitrary address. Check for invalid command and return error. CRs-Fixed: 2299567 Change-Id: Ibd77adfe53ef0777ff4eb96c914e21f43dfd6749 Signed-off-by: E V Ravi --- .../media/platform/msm/ais/sensor/ir_led/msm_ir_led.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/media/platform/msm/ais/sensor/ir_led/msm_ir_led.c b/drivers/media/platform/msm/ais/sensor/ir_led/msm_ir_led.c index 9e200071f9eb..1492d19d21d6 100644 --- a/drivers/media/platform/msm/ais/sensor/ir_led/msm_ir_led.c +++ b/drivers/media/platform/msm/ais/sensor/ir_led/msm_ir_led.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -312,10 +312,6 @@ static long msm_ir_led_subdev_do_ioctl( (struct msm_ir_led_cfg_data_t32 *)arg; struct msm_ir_led_cfg_data_t ir_led_data; - ir_led_data.cfg_type = u32->cfg_type; - ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns; - ir_led_data.pwm_period_ns = u32->pwm_period_ns; - switch (cmd) { case VIDIOC_MSM_IR_LED_CFG32: cmd = VIDIOC_MSM_IR_LED_CFG; @@ -324,6 +320,10 @@ static long msm_ir_led_subdev_do_ioctl( return msm_ir_led_subdev_ioctl(sd, cmd, arg); } + ir_led_data.cfg_type = u32->cfg_type; + ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns; + ir_led_data.pwm_period_ns = u32->pwm_period_ns; + rc = msm_ir_led_subdev_ioctl(sd, cmd, &ir_led_data); return rc;