Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8555d2d authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: cpp: Avoid exposing kernel information to user space"

parents e2d10872 0fa56849

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+18 −9
Original line number Diff line number Diff line
@@ -3835,6 +3835,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
	struct msm_cpp_frame_info32_t k32_frame_info;

	struct msm_cpp_frame_info_t k64_frame_info;

	uint32_t identity_k = 0;

	bool is_copytouser_req = true;

	void __user *up = (void __user *)arg;



	if (sd == NULL) {
@@ -3969,9 +3970,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
				break;

			}

		}

		if (copy_to_user(

				(void __user *)kp_ioctl.ioctl_ptr, &inst_info,

				sizeof(struct msm_cpp_frame_info32_t))) {

		if (copy_to_user((void __user *)kp_ioctl.ioctl_ptr,

			&inst_info, sizeof(struct msm_cpp_frame_info32_t))) {

			mutex_unlock(&cpp_dev->mutex);

			return -EFAULT;

		}
@@ -4007,6 +4007,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
				  sizeof(struct msm_cpp_stream_buff_info_t);

			}

		}

		is_copytouser_req = false;

		if (cmd == VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO32)

			cmd = VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO;

		else if (cmd == VIDIOC_MSM_CPP_DELETE_STREAM_BUFF32)
@@ -4021,6 +4022,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
		get_user(identity_k, identity_u);

		kp_ioctl.ioctl_ptr = (void *)&identity_k;

		kp_ioctl.len = sizeof(uint32_t);

		is_copytouser_req = false;

		cmd = VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO;

		break;

	}
@@ -4079,6 +4081,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
					sizeof(struct msm_cpp_clock_settings_t);

			}

		}

		is_copytouser_req = false;

		cmd = VIDIOC_MSM_CPP_SET_CLOCK;

		break;

	}
@@ -4104,6 +4107,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 


		kp_ioctl.ioctl_ptr = (void *)&k_queue_buf;

		kp_ioctl.len = sizeof(struct msm_pproc_queue_buf_info);

		is_copytouser_req = false;

		cmd = VIDIOC_MSM_CPP_QUEUE_BUF;

		break;

	}
@@ -4128,6 +4132,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
		k64_frame_info.frame_id = k32_frame_info.frame_id;



		kp_ioctl.ioctl_ptr = (void *)&k64_frame_info;



		is_copytouser_req = false;

		cmd = VIDIOC_MSM_CPP_POP_STREAM_BUFFER;

		break;

	}
@@ -4181,13 +4187,16 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
		break;

	}



	if (is_copytouser_req) {

		up32_ioctl.id = kp_ioctl.id;

		up32_ioctl.len = kp_ioctl.len;

		up32_ioctl.trans_code = kp_ioctl.trans_code;

		up32_ioctl.ioctl_ptr = ptr_to_compat(kp_ioctl.ioctl_ptr);



	if (copy_to_user((void __user *)up, &up32_ioctl, sizeof(up32_ioctl)))

		if (copy_to_user((void __user *)up, &up32_ioctl,

			sizeof(up32_ioctl)))

			return -EFAULT;

	}



	return rc;

}