diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-03-04 02:56:17 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-04 02:56:17 -0800 |
| commit | b398385a00c9080bd00fdaf363d8824c49cd7eb0 (patch) | |
| tree | 5f726aa374370f16a35f3ac42fb0c677baf76a4b /drivers/media | |
| parent | b64db613f2aa38abe2a4907b2a493f41e17390b5 (diff) | |
| parent | 88ad6090d3bef22c2330f7c068f24bad73e0b220 (diff) | |
Merge "msm: camera: Lack of copy_from_user in camera driver."
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/msm.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/drivers/media/platform/msm/camera_v2/msm.c b/drivers/media/platform/msm/camera_v2/msm.c index 5cf5582b55ab..c2b42a854d35 100644 --- a/drivers/media/platform/msm/camera_v2/msm.c +++ b/drivers/media/platform/msm/camera_v2/msm.c @@ -1119,17 +1119,21 @@ long msm_copy_camera_private_ioctl_args(unsigned long arg, struct msm_camera_private_ioctl_arg *k_ioctl, void __user **tmp_compat_ioctl_ptr) { - struct msm_camera_private_ioctl_arg *up_ioctl_ptr = - (struct msm_camera_private_ioctl_arg *)arg; + struct msm_camera_private_ioctl_arg up_ioctl; if (WARN_ON(!arg || !k_ioctl || !tmp_compat_ioctl_ptr)) return -EIO; - k_ioctl->id = up_ioctl_ptr->id; - k_ioctl->size = up_ioctl_ptr->size; - k_ioctl->result = up_ioctl_ptr->result; - k_ioctl->reserved = up_ioctl_ptr->reserved; - *tmp_compat_ioctl_ptr = compat_ptr(up_ioctl_ptr->ioctl_ptr); + if (copy_from_user(&up_ioctl, + (struct msm_camera_private_ioctl_arg *)arg, + sizeof(struct msm_camera_private_ioctl_arg))) + return -EFAULT; + + k_ioctl->id = up_ioctl.id; + k_ioctl->size = up_ioctl.size; + k_ioctl->result = up_ioctl.result; + k_ioctl->reserved = up_ioctl.reserved; + *tmp_compat_ioctl_ptr = compat_ptr(up_ioctl.ioctl_ptr); return 0; } |