diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-25 19:49:17 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-25 19:49:17 -0800 |
| commit | f8555d2da6522fe58372e3ef78aac3b73dbd97b8 (patch) | |
| tree | ae887474cfa97938ba27fc81d3ad7471d3c31813 /drivers | |
| parent | e2d10872493673098a101c7bbf0a3f455e02fe50 (diff) | |
| parent | 0fa56849d1d23e8b77827d61b0c192855a23ee46 (diff) | |
Merge "msm: camera: cpp: Avoid exposing kernel information to user space"
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c | 27 |
1 files changed, 18 insertions, 9 deletions
diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c index da31dcd84b11..064c1e8c5bab 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c +++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c @@ -3835,6 +3835,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, struct msm_cpp_frame_info32_t k32_frame_info; struct msm_cpp_frame_info_t k64_frame_info; uint32_t identity_k = 0; + bool is_copytouser_req = true; void __user *up = (void __user *)arg; if (sd == NULL) { @@ -3969,9 +3970,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, break; } } - if (copy_to_user( - (void __user *)kp_ioctl.ioctl_ptr, &inst_info, - sizeof(struct msm_cpp_frame_info32_t))) { + if (copy_to_user((void __user *)kp_ioctl.ioctl_ptr, + &inst_info, sizeof(struct msm_cpp_frame_info32_t))) { mutex_unlock(&cpp_dev->mutex); return -EFAULT; } @@ -4007,6 +4007,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, sizeof(struct msm_cpp_stream_buff_info_t); } } + is_copytouser_req = false; if (cmd == VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO32) cmd = VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO; else if (cmd == VIDIOC_MSM_CPP_DELETE_STREAM_BUFF32) @@ -4021,6 +4022,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, get_user(identity_k, identity_u); kp_ioctl.ioctl_ptr = (void *)&identity_k; kp_ioctl.len = sizeof(uint32_t); + is_copytouser_req = false; cmd = VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO; break; } @@ -4079,6 +4081,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, sizeof(struct msm_cpp_clock_settings_t); } } + is_copytouser_req = false; cmd = VIDIOC_MSM_CPP_SET_CLOCK; break; } @@ -4104,6 +4107,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, kp_ioctl.ioctl_ptr = (void *)&k_queue_buf; kp_ioctl.len = sizeof(struct msm_pproc_queue_buf_info); + is_copytouser_req = false; cmd = VIDIOC_MSM_CPP_QUEUE_BUF; break; } @@ -4128,6 +4132,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, k64_frame_info.frame_id = k32_frame_info.frame_id; kp_ioctl.ioctl_ptr = (void *)&k64_frame_info; + + is_copytouser_req = false; cmd = VIDIOC_MSM_CPP_POP_STREAM_BUFFER; break; } @@ -4181,13 +4187,16 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, break; } - up32_ioctl.id = kp_ioctl.id; - up32_ioctl.len = kp_ioctl.len; - up32_ioctl.trans_code = kp_ioctl.trans_code; - up32_ioctl.ioctl_ptr = ptr_to_compat(kp_ioctl.ioctl_ptr); + if (is_copytouser_req) { + up32_ioctl.id = kp_ioctl.id; + up32_ioctl.len = kp_ioctl.len; + up32_ioctl.trans_code = kp_ioctl.trans_code; + up32_ioctl.ioctl_ptr = ptr_to_compat(kp_ioctl.ioctl_ptr); - if (copy_to_user((void __user *)up, &up32_ioctl, sizeof(up32_ioctl))) - return -EFAULT; + if (copy_to_user((void __user *)up, &up32_ioctl, + sizeof(up32_ioctl))) + return -EFAULT; + } return rc; } |