Commit 10f1e052 authored Jul 18, 2017 by Rahul Sharma Committed by Andy Sun Jul 25, 2017

msm: sensor: Fix for variable being de-referenced without proper check



Pointer from userspace is de-referenced before the command is checked.
This might cause a crash if the command being sent is not a valid command.
Hence changing the de-reference such that the pointer is accessed after
checking if a valid command is sent from the userspace.

Change-Id: Iba2e2da5b5adfa0323f8b7d56445af14acd58f84
CR fixed: 2053970
Signed-off-by: Rahul Sharma <sharah@codeaurora.org>
Signed-off-by: Andy Sun <bins@codeaurora.org>

parent 26bb59b7

drivers/media/platform/msm/ais/sensor/ois/msm_ois.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -781,6 +781,7 @@ static long msm_ois_subdev_do_ioctl(
		u32 = (struct msm_ois_cfg_data32 *)arg;
		parg = arg;


		switch (cmd) {
		case VIDIOC_MSM_OIS_CFG32:
		cmd = VIDIOC_MSM_OIS_CFG;
		@@ -818,7 +819,6 @@ static long msm_ois_subdev_do_ioctl(
		settings.reg_setting =
		compat_ptr(settings32.reg_setting);

		ois_data.cfgtype = u32->cfgtype;
		ois_data.cfg.settings = &settings;
		parg = &ois_data;
		break;