evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: camera: cpp: Avoid exposing kernel information to user space"

Browse source
This commit is contained in:
Linux Build Service Account 2017-02-25 19:49:17 -08:00 • committed by Gerrit - the friendly Code Review server
commit f8555d2da6
1 changed files with 18 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
View file

@ -3835,6 +3835,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
struct msm_cpp_frame_info32_t k32_frame_info;
struct msm_cpp_frame_info_t k64_frame_info;
uint32_t identity_k = 0;
bool is_copytouser_req = true;
void __user *up = (void __user *)arg;
if (sd == NULL) {
@ -3969,9 +3970,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
break;
}
}
if (copy_to_user(
(void __user *)kp_ioctl.ioctl_ptr, &inst_info,
sizeof(struct msm_cpp_frame_info32_t))) {
if (copy_to_user((void __user *)kp_ioctl.ioctl_ptr,
&inst_info, sizeof(struct msm_cpp_frame_info32_t))) {
mutex_unlock(&cpp_dev->mutex);
return -EFAULT;
}
@ -4007,6 +4007,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
sizeof(struct msm_cpp_stream_buff_info_t);
}
}
is_copytouser_req = false;
if (cmd == VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO32)
cmd = VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO;
else if (cmd == VIDIOC_MSM_CPP_DELETE_STREAM_BUFF32)
@ -4021,6 +4022,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
get_user(identity_k, identity_u);
kp_ioctl.ioctl_ptr = (void *)&identity_k;
kp_ioctl.len = sizeof(uint32_t);
is_copytouser_req = false;
cmd = VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO;
break;
}
@ -4079,6 +4081,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
sizeof(struct msm_cpp_clock_settings_t);
}
}
is_copytouser_req = false;
cmd = VIDIOC_MSM_CPP_SET_CLOCK;
break;
}
@ -4104,6 +4107,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
kp_ioctl.ioctl_ptr = (void *)&k_queue_buf;
kp_ioctl.len = sizeof(struct msm_pproc_queue_buf_info);
is_copytouser_req = false;
cmd = VIDIOC_MSM_CPP_QUEUE_BUF;
break;
}
@ -4128,6 +4132,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
k64_frame_info.frame_id = k32_frame_info.frame_id;
kp_ioctl.ioctl_ptr = (void *)&k64_frame_info;
is_copytouser_req = false;
cmd = VIDIOC_MSM_CPP_POP_STREAM_BUFFER;
break;
}
@ -4181,13 +4187,16 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
break;
}
up32_ioctl.id = kp_ioctl.id;
up32_ioctl.len = kp_ioctl.len;
up32_ioctl.trans_code = kp_ioctl.trans_code;
up32_ioctl.ioctl_ptr = ptr_to_compat(kp_ioctl.ioctl_ptr);
if (is_copytouser_req) {
up32_ioctl.id = kp_ioctl.id;
up32_ioctl.len = kp_ioctl.len;
up32_ioctl.trans_code = kp_ioctl.trans_code;
up32_ioctl.ioctl_ptr = ptr_to_compat(kp_ioctl.ioctl_ptr);
if (copy_to_user((void __user *)up, &up32_ioctl, sizeof(up32_ioctl)))
return -EFAULT;
if (copy_to_user((void __user *)up, &up32_ioctl,
sizeof(up32_ioctl)))
return -EFAULT;
}
return rc;
}