Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e498718 authored by Tanvi Aggarwal's avatar Tanvi Aggarwal Committed by Gerrit - the friendly Code Review server
Browse files

msm-camera: sensor: Fixing kernel crash during i2c read 



When userspace uses ioctl(), kernel should get the data from
userpsace through copy_from_user() or get_user() and send it
back to userpsace though copy_to_user() or put_user().
In this case, kernel is not using put_user or copy_to_user
which is leading to a crash during I2C read when it tries to
access memory.

CRs-Fixed: 2058381
Change-Id: Ie5596b62cb589ee048e54f37c7e6beda0d62cad5
Signed-off-by: default avatarTanvi Aggarwal <tanvia@codeaurora.org>
parent a25d7287

drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c

+13 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -584,7 +584,12 @@ static int msm_sensor_config32(struct msm_sensor_ctrl_t *s_ctrl, 
			pr_err("%s:%d: i2c_read failed\n", __func__, __LINE__);

			break;

		}

		read_config_ptr->data = local_data;

		if (copy_to_user(&read_config_ptr->data,

				&local_data, sizeof(local_data))) {

			pr_err("%s:%d failed\n", __func__, __LINE__);

			rc = -EFAULT;

			break;

		}

		break;

	}

	case CFG_SLAVE_WRITE_I2C_ARRAY: {
@@ -1098,7 +1103,12 @@ int msm_sensor_config(struct msm_sensor_ctrl_t *s_ctrl, void __user *argp) 
			pr_err("%s:%d: i2c_read failed\n", __func__, __LINE__);

			break;

		}

		read_config_ptr->data = local_data;

		if (copy_to_user(&read_config_ptr->data,

				&local_data, sizeof(local_data))) {

			pr_err("%s:%d failed\n", __func__, __LINE__);

			rc = -EFAULT;

			break;

		}

		break;

	}

	case CFG_SLAVE_WRITE_I2C_ARRAY: {