Commit fa5ee0d2 authored Apr 18, 2017 by Trishansh Bhardwaj Committed by Gerrit - the friendly Code Review server Apr 25, 2017

msm: camera: Fix kernel overwrite GET_BUF_BY_IDX ioctl



Assign address of buf_info into ioctl_ptr.
Previously we were copying first 8 bytes of buf_info (content)
into ioctl_ptr. Which is dereferenced and written later causing
kernel overwrite vulnerability.

Change-Id: Ie5deae249da8208523027f8ec5632f960757e9bd
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>

parent 048c7007

drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -553,8 +553,7 @@ static long msm_buf_mngr_subdev_ioctl(struct v4l2_subdev *sd,
		sizeof(struct msm_buf_mngr_info))) {
		return -EFAULT;
		}
		MSM_CAM_GET_IOCTL_ARG_PTR(&k_ioctl.ioctl_ptr,
		&buf_info, sizeof(void *));
		k_ioctl.ioctl_ptr = (uintptr_t)&buf_info;
		argp = &k_ioctl;
		rc = msm_cam_buf_mgr_ops(cmd, argp);
		}