Merge "msm: camera: jpegdma: Check for compat config" (60297d10) · Commits · e / devices / android_kernel_sony_msm8998

drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c

+21 −2

Original line number	Diff line number	Diff line
		@@ -127,6 +127,21 @@ static inline void msm_jpegdma_schedule_next_config(struct jpegdma_ctx *ctx)
		ctx->config_idx = (ctx->config_idx + 1) % MSM_JPEGDMA_MAX_CONFIGS;
		}

		/*
		* msm_jpegdma_cast_long_to_buff_ptr - Cast long to buffer pointer.
		* @vaddr: vaddr as long
		* @buff_ptr_head: buffer pointer head
		*/
		static inline void msm_jpegdma_cast_long_to_buff_ptr(unsigned long vaddr,
		struct msm_jpeg_dma_buff **buff_ptr_head)
		{
		#ifdef CONFIG_COMPAT
		*buff_ptr_head = compat_ptr(vaddr);
		#else
		buff_ptr_head = (struct msm_jpeg_dma_buff ) vaddr;
		#endif
		}

		/*
		* msm_jpegdma_get_format_idx - Get jpeg dma format lookup index.
		* @ctx: Pointer to dma ctx.
		@@ -410,10 +425,12 @@ static void msm_jpegdma_get_userptr(void alloc_ctx,
		{
		struct msm_jpegdma_device *dma = alloc_ctx;
		struct msm_jpegdma_buf_handle *buf;
		struct msm_jpeg_dma_buff __user *up_buff = compat_ptr(vaddr);
		struct msm_jpeg_dma_buff __user *up_buff;
		struct msm_jpeg_dma_buff kp_buff;
		int ret;

		msm_jpegdma_cast_long_to_buff_ptr(vaddr, &up_buff);

		if (!access_ok(VERIFY_READ, up_buff,
		sizeof(struct msm_jpeg_dma_buff)) \|\|
		get_user(kp_buff.fd, &up_buff->fd)) {
		@@ -813,10 +830,12 @@ static int msm_jpegdma_qbuf(struct file file, void fh,
		struct v4l2_buffer *buf)
		{
		struct jpegdma_ctx *ctx = msm_jpegdma_ctx_from_fh(fh);
		struct msm_jpeg_dma_buff __user *up_buff = compat_ptr(buf->m.userptr);
		struct msm_jpeg_dma_buff __user *up_buff;
		struct msm_jpeg_dma_buff kp_buff;
		int ret;

		msm_jpegdma_cast_long_to_buff_ptr(buf->m.userptr, &up_buff);

		if (!access_ok(VERIFY_READ, up_buff,
		sizeof(struct msm_jpeg_dma_buff)) \|\|
		get_user(kp_buff.fd, &up_buff->fd) \|\|