Merge "msm: camera: validate user space parameter for max and min value" (d5e312a9) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c

+17 −6

Original line number	Diff line number	Diff line
		@@ -503,8 +503,11 @@ static int32_t msm_actuator_piezo_move_focus(
		return -EFAULT;
		}

		if (num_steps == 0)
		return rc;
		if (num_steps <= 0 \|\| num_steps > MAX_NUMBER_OF_STEPS) {
		pr_err("num_steps out of range = %d\n",
		num_steps);
		return -EFAULT;
		}

		a_ctrl->i2c_tbl_index = 0;
		a_ctrl->func_tbl->actuator_parse_i2c_params(a_ctrl,
		@@ -1034,8 +1037,12 @@ static int32_t msm_actuator_set_position(
		uint32_t hw_params = 0;
		struct msm_camera_i2c_reg_setting reg_setting;
		CDBG("%s Enter %d\n", __func__, __LINE__);
		if (set_pos->number_of_steps == 0)
		return rc;
		if (set_pos->number_of_steps <= 0 \|\|
		set_pos->number_of_steps > MAX_NUMBER_OF_STEPS) {
		pr_err("num_steps out of range = %d\n",
		set_pos->number_of_steps);
		return -EFAULT;
		}

		a_ctrl->i2c_tbl_index = 0;
		for (index = 0; index < set_pos->number_of_steps; index++) {
		@@ -1072,8 +1079,12 @@ static int32_t msm_actuator_bivcm_set_position(
		uint16_t delay;
		uint32_t hw_params = 0;
		CDBG("%s Enter %d\n", __func__, __LINE__);
		if (set_pos->number_of_steps == 0)
		return rc;
		if (set_pos->number_of_steps <= 0 \|\|
		set_pos->number_of_steps > MAX_NUMBER_OF_STEPS) {
		pr_err("num_steps out of range = %d\n",
		set_pos->number_of_steps);
		return -EFAULT;
		}

		a_ctrl->i2c_tbl_index = 0;
		for (index = 0; index < set_pos->number_of_steps; index++) {