Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8d6e171 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: bufmgr: Fix crash due to improper use of compat_ptr"

parents 15bef402 7c1495b1

drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c

+17 −17
Original line number Diff line number Diff line
@@ -191,21 +191,21 @@ static long msm_bmgr_subdev_fops_compat_ioctl(struct file *file, 
	struct v4l2_subdev *sd = vdev_to_v4l2_subdev(vdev);

	int32_t rc = 0;



	void __user *up = compat_ptr(arg);

	void __user *up = (void __user *)arg;



	struct msm_buf_mngr_info32_t *buf_info32 = NULL;

	struct msm_buf_mngr_info *buf_info;

	struct msm_buf_mngr_info32_t buf_info32;

	struct msm_buf_mngr_info buf_info;



	if (copy_from_user(buf_info32, (void __user *)up,

	if (copy_from_user(&buf_info32, (void __user *)up,

				sizeof(struct msm_buf_mngr_info32_t)))

		return -EFAULT;



	buf_info->session_id = buf_info32->session_id;

	buf_info->stream_id = buf_info32->stream_id;

	buf_info->frame_id = buf_info32->frame_id;

	buf_info->index = buf_info32->index;

	buf_info->timestamp.tv_sec = (long) buf_info32->timestamp.tv_sec;

	buf_info->timestamp.tv_usec = (long) buf_info32->timestamp.tv_usec;

	buf_info.session_id = buf_info32.session_id;

	buf_info.stream_id = buf_info32.stream_id;

	buf_info.frame_id = buf_info32.frame_id;

	buf_info.index = buf_info32.index;

	buf_info.timestamp.tv_sec = (long) buf_info32.timestamp.tv_sec;

	buf_info.timestamp.tv_usec = (long) buf_info32.timestamp.tv_usec;



	/* Convert 32 bit IOCTL ID's to 64 bit IOCTL ID's

	 * except VIDIOC_MSM_CPP_CFG32, which needs special
@@ -230,20 +230,20 @@ static long msm_bmgr_subdev_fops_compat_ioctl(struct file *file, 
	case VIDIOC_MSM_BUF_MNGR_GET_BUF:

	case VIDIOC_MSM_BUF_MNGR_BUF_DONE:

	case VIDIOC_MSM_BUF_MNGR_PUT_BUF:

		rc = v4l2_subdev_call(sd, core, ioctl, cmd, buf_info);

		rc = v4l2_subdev_call(sd, core, ioctl, cmd, &buf_info);

		break;

	default:

		pr_debug("%s : unsupported compat type", __func__);

		break;

	}



	buf_info32->session_id = buf_info->session_id;

	buf_info32->stream_id = buf_info->stream_id;

	buf_info32->index = buf_info->index;

	buf_info32->timestamp.tv_sec = (int32_t) buf_info->timestamp.tv_sec;

	buf_info32->timestamp.tv_usec = (int32_t) buf_info->timestamp.tv_usec;

	buf_info32.session_id = buf_info.session_id;

	buf_info32.stream_id = buf_info.stream_id;

	buf_info32.index = buf_info.index;

	buf_info32.timestamp.tv_sec = (int32_t) buf_info.timestamp.tv_sec;

	buf_info32.timestamp.tv_usec = (int32_t) buf_info.timestamp.tv_usec;



	if (copy_to_user((void __user *)up, buf_info32,

	if (copy_to_user((void __user *)up, &buf_info32,

			sizeof(struct msm_buf_mngr_info32_t)))

		return -EFAULT;