Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 158dff0e authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

media: atomisp: compat32: use get_user() before referencing user data 



The logic at get_atomisp_parameters32() is broken, as pointed by
smatch:

	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:21: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:744:60: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:763:21: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:770:60: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:21: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:795:60: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:812:21: warning: dereference of noderef expression
	drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:819:60: warning: dereference of noderef expression

It tries to access userspace data directly, without calling
get_user(). That should generate OOPS. Thankfully, the right
logic is already there (although commented out).

Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent ea72fbf5

drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c

+0 −38
Original line number Diff line number Diff line
@@ -691,10 +691,8 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, 
				sizeof(compat_uptr_t);

	unsigned int size, offset = 0;

	void  __user *user_ptr;

#ifdef ISP2401

	unsigned int stp, mtp, dcp, dscp = 0;



#endif

	if (!access_ok(VERIFY_READ, up, sizeof(struct atomisp_parameters32)))

			return -EFAULT;
@@ -707,15 +705,11 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, 
		n--;

	}

	if (get_user(kp->isp_config_id, &up->isp_config_id) ||

#ifndef ISP2401

	    get_user(kp->per_frame_setting, &up->per_frame_setting))

#else

	    get_user(kp->per_frame_setting, &up->per_frame_setting) ||

	    get_user(stp, &up->shading_table) ||

	    get_user(mtp, &up->morph_table) ||

	    get_user(dcp, &up->dvs2_coefs) ||

	    get_user(dscp, &up->dvs_6axis_config))

#endif

		return -EFAULT;



	{
@@ -733,18 +727,10 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, 
		user_ptr = compat_alloc_user_space(size);



		/* handle shading table */

#ifndef ISP2401

		if (up->shading_table != 0) {

#else

		if (stp != 0) {

#endif

			if (get_atomisp_shading_table32(&karg.shading_table,

				(struct atomisp_shading_table32 __user *)

#ifndef ISP2401

						(uintptr_t)up->shading_table))

#else

						(uintptr_t)stp))

#endif

				return -EFAULT;



			kp->shading_table = user_ptr + offset;
@@ -759,18 +745,10 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, 
		}



		/* handle morph table */

#ifndef ISP2401

		if (up->morph_table != 0) {

#else

		if (mtp != 0) {

#endif

			if (get_atomisp_morph_table32(&karg.morph_table,

					(struct atomisp_morph_table32 __user *)

#ifndef ISP2401

						(uintptr_t)up->morph_table))

#else

						(uintptr_t)mtp))

#endif

				return -EFAULT;



			kp->morph_table = user_ptr + offset;
@@ -784,18 +762,10 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, 
		}



		/* handle dvs2 coefficients */

#ifndef ISP2401

		if (up->dvs2_coefs != 0) {

#else

		if (dcp != 0) {

#endif

			if (get_atomisp_dis_coefficients32(&karg.dvs2_coefs,

				(struct atomisp_dis_coefficients32 __user *)

#ifndef ISP2401

						(uintptr_t)up->dvs2_coefs))

#else

						(uintptr_t)dcp))

#endif

				return -EFAULT;



			kp->dvs2_coefs = user_ptr + offset;
@@ -808,18 +778,10 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, 
				return -EFAULT;

		}

		/* handle dvs 6axis configuration */

#ifndef ISP2401

		if (up->dvs_6axis_config != 0) {

#else

		if (dscp != 0) {

#endif

			if (get_atomisp_dvs_6axis_config32(&karg.dvs_6axis_config,

				(struct atomisp_dvs_6axis_config32 __user *)

#ifndef ISP2401

						(uintptr_t)up->dvs_6axis_config))

#else

						(uintptr_t)dscp))

#endif

				return -EFAULT;



			kp->dvs_6axis_config = user_ptr + offset;