Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2531aec8 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: camera: Lack of copy_from_user in camera driver."

parents a6e622a8 b5f41b05
Loading
Loading
Loading
Loading
+11 −7
Original line number Diff line number Diff line
@@ -1104,17 +1104,21 @@ long msm_copy_camera_private_ioctl_args(unsigned long arg,
	struct msm_camera_private_ioctl_arg *k_ioctl,
	void __user **tmp_compat_ioctl_ptr)
{
	struct msm_camera_private_ioctl_arg *up_ioctl_ptr =
		(struct msm_camera_private_ioctl_arg *)arg;
	struct msm_camera_private_ioctl_arg up_ioctl;

	if (WARN_ON(!arg || !k_ioctl || !tmp_compat_ioctl_ptr))
		return -EIO;

	k_ioctl->id = up_ioctl_ptr->id;
	k_ioctl->size = up_ioctl_ptr->size;
	k_ioctl->result = up_ioctl_ptr->result;
	k_ioctl->reserved = up_ioctl_ptr->reserved;
	*tmp_compat_ioctl_ptr = compat_ptr(up_ioctl_ptr->ioctl_ptr);
	if (copy_from_user(&up_ioctl,
		(struct msm_camera_private_ioctl_arg *)arg,
		sizeof(struct msm_camera_private_ioctl_arg)))
		return -EFAULT;

	k_ioctl->id = up_ioctl.id;
	k_ioctl->size = up_ioctl.size;
	k_ioctl->result = up_ioctl.result;
	k_ioctl->reserved = up_ioctl.reserved;
	*tmp_compat_ioctl_ptr = compat_ptr(up_ioctl.ioctl_ptr);

	return 0;
}