Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a28192b2 authored by Seemanta Dutta's avatar Seemanta Dutta
Browse files

msm: camera: cpp: Fix cpp ioctl errors 



Fix the following two issues:

1. Copying error in case of 64bit compat mode caused by
calling copy_from_user() over a kernel space address.
Fix this by calling memcpy() in case of 64bit compat mode.

2. Invalid length caused by passing size of 32bit
compat structure from user space. Fix this by patching
up the size of the argument to its 64bit counterpart.

Change-Id: I704e7535fe9a9f72b31427e3121beb77056979c8
Signed-off-by: default avatarSeemanta Dutta <seemanta@codeaurora.org>
parent 39b4eba2

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+15 −3
Original line number Diff line number Diff line
@@ -1638,7 +1638,16 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, 
			pr_err("%s:%d: malloc error\n", __func__, __LINE__);

			mutex_unlock(&cpp_dev->mutex);

			return -EINVAL;

		} else {

		}

#ifdef CONFIG_COMPAT

		/* For compat task, source ptr is in kernel space

		 * otherwise it is in user space*/

		if (is_compat_task()) {

			memcpy(u_stream_buff_info, ioctl_ptr->ioctl_ptr,

					ioctl_ptr->len);

		} else

#else

		{

			rc = (copy_from_user(u_stream_buff_info,

					(void __user *)ioctl_ptr->ioctl_ptr,

					ioctl_ptr->len) ? -EFAULT : 0);
@@ -1649,7 +1658,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, 
				return -EINVAL;

			}

		}



#endif

		if (u_stream_buff_info->num_buffs == 0) {

			pr_err("%s:%d: Invalid number of buffers\n", __func__,

				__LINE__);
@@ -2214,6 +2223,9 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
			if (kp_ioctl.len != sizeof(

				struct msm_cpp_stream_buff_info32_t))

				return -EINVAL;

			else

				kp_ioctl.len =

				  sizeof(struct msm_cpp_stream_buff_info_t);

		}

		cmd = VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO;

		break;