Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dce17fb3 authored by Satish Kodishala's avatar Satish Kodishala
Browse files

radio: iris: Checking if driver's buffer is large enough. 



Checking if driver's buffer is large enough to copy
the data from user space.

Change-Id: I7b1a369e1334b1731c8704913aa6834eace6a050
CRs-fixed: 552329
Signed-off-by: default avatarSatish Kodishala <skodisha@codeaurora.org>
parent e11a9da9

drivers/media/radio/radio-iris.c

+24 −7
Original line number Diff line number Diff line
@@ -3476,18 +3476,35 @@ static int iris_vidioc_s_ctrl(struct file *file, void *priv, 
		radio->riva_data_req.cmd_params.start_addr = ctrl->value;

		break;

	case V4L2_CID_PRIVATE_IRIS_RIVA_ACCS_LEN:

		if ((ctrl->value > 0) &&

			(ctrl->value <= MAX_RIVA_PEEK_RSP_SIZE)) {

			radio->riva_data_req.cmd_params.length = ctrl->value;

		} else {

			FMDERR("Length %d is more than the buffer size %d\n",

			ctrl->value, MAX_RIVA_PEEK_RSP_SIZE);

			retval = -EINVAL;

		}

		break;

	case V4L2_CID_PRIVATE_IRIS_RIVA_POKE:

		retval = copy_from_user(radio->riva_data_req.data,

		if (radio->riva_data_req.cmd_params.length <=

		    MAX_RIVA_PEEK_RSP_SIZE) {

			retval = copy_from_user(

					radio->riva_data_req.data,

					(void *)ctrl->value,

					radio->riva_data_req.cmd_params.length);

			if (retval != 0) {

				retval = -retval;

				break;

			}

		radio->riva_data_req.cmd_params.subopcode = RIVA_POKE_OPCODE;

		retval = hci_poke_data(&radio->riva_data_req , radio->fm_hdev);

			radio->riva_data_req.cmd_params.subopcode =

						RIVA_POKE_OPCODE;

			retval = hci_poke_data(

					&radio->riva_data_req,

					radio->fm_hdev);

		} else {

			FMDERR("Can not copy into driver's buffer.\n");

			retval = -EINVAL;

		}

		break;

	case V4L2_CID_PRIVATE_IRIS_SSBI_ACCS_ADDR:

		radio->ssbi_data_accs.start_addr = ctrl->value;