Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a745ac61 authored by Abhishek Abbanaveni's avatar Abhishek Abbanaveni Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Fix for OOB security CR 



If user passes an aribitary command with _IOC_DIR(cmd) == _IOC_NONE,
"arg" should not point to any arbitrary address.
Check for invalid command and return error.

Change-Id: Ieae6c79a836d0ae71055725d7994a01bf17b9e05
Signed-off-by: default avatarAbhishek Abbanaveni <aabban@codeaurora.org>
parent ba1a7cac

drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c

+5 −5
Original line number Diff line number Diff line 
/* Copyright (c) 2016, 2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2016-2018 The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -324,10 +324,6 @@ static long msm_ir_led_subdev_do_ioctl( 
	struct msm_ir_led_cfg_data_t ir_led_data;



	CDBG("Enter\n");

	ir_led_data.cfg_type = u32->cfg_type;

	ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns;

	ir_led_data.pwm_period_ns = u32->pwm_period_ns;



	switch (cmd) {

	case VIDIOC_MSM_IR_LED_CFG32:

		cmd = VIDIOC_MSM_IR_LED_CFG;
@@ -336,6 +332,10 @@ static long msm_ir_led_subdev_do_ioctl( 
		return msm_ir_led_subdev_ioctl(sd, cmd, arg);

	}



	ir_led_data.cfg_type = u32->cfg_type;

	ir_led_data.pwm_duty_on_ns = u32->pwm_duty_on_ns;

	ir_led_data.pwm_period_ns = u32->pwm_period_ns;



	rc = msm_ir_led_subdev_ioctl(sd, cmd, &ir_led_data);



	CDBG("Exit\n");