diff options
| author | Abhishek Abbanaveni <aabban@codeaurora.org> | 2018-11-20 14:57:06 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-12-04 01:14:58 -0800 |
| commit | 4d15ce59f5f89eec92658e0c51453e7fce95aa77 (patch) | |
| tree | 9e6c244a6f70ec431abae85ab8e170c9887ae269 /drivers | |
| parent | 8a475d4ba16373d30f8a57f8e2ee8f997dd00fbb (diff) | |
msm: camera: Fix for OOB security CR
If user passes an aribitary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should point to any arbitrary address.
Check for invalid command and return error.
Change-Id: If60191a07bb80939af2d471a5acf1b17dd68aa58
CRs-Fixed: 2299567
Signed-off-by: Abhishek Abbanaveni <aabban@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c b/drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c index 9af7abc5cd04..e4d095d1a882 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c +++ b/drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016-2018 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -324,10 +324,6 @@ static long msm_ir_led_subdev_do_ioctl( struct msm_ir_led_cfg_data_t ir_led_data; CDBG("Enter\n"); - ir_led_data.cfg_type = u32->cfg_type; - ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns; - ir_led_data.pwm_period_ns = u32->pwm_period_ns; - switch (cmd) { case VIDIOC_MSM_IR_LED_CFG32: cmd = VIDIOC_MSM_IR_LED_CFG; @@ -336,6 +332,10 @@ static long msm_ir_led_subdev_do_ioctl( return msm_ir_led_subdev_ioctl(sd, cmd, arg); } + ir_led_data.cfg_type = u32->cfg_type; + ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns; + ir_led_data.pwm_period_ns = u32->pwm_period_ns; + rc = msm_ir_led_subdev_ioctl(sd, cmd, &ir_led_data); CDBG("Exit\n"); |