Merge "msm: camera2: cpp: Avoid incorrect argument access in IOCTL" (2b26b0ae) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+32 −4

Original line number	Diff line number	Diff line
		@@ -2500,16 +2500,39 @@ static void msm_cpp_fw_version(struct cpp_device *cpp_dev)
		msm_cpp_poll(cpp_dev->base, MSM_CPP_MSG_ID_TRAILER);
		}

		static int msm_cpp_validate_input(unsigned int cmd, void *arg,
		struct msm_camera_v4l2_ioctl_t **ioctl_ptr)
		{
		switch (cmd) {
		case MSM_SD_SHUTDOWN:
		break;
		default: {
		if (ioctl_ptr == NULL) {
		pr_err("Wrong ioctl_ptr %p\n", ioctl_ptr);
		return -EINVAL;
		}

		*ioctl_ptr = arg;
		if ((*ioctl_ptr == NULL) \|\|
		((*ioctl_ptr)->ioctl_ptr == NULL)) {
		pr_err("Wrong arg %p\n", arg);
		return -EINVAL;
		}
		break;
		}
		}
		return 0;
		}

		long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
		unsigned int cmd, void *arg)
		{
		struct cpp_device *cpp_dev = NULL;
		struct msm_camera_v4l2_ioctl_t *ioctl_ptr = arg;
		struct msm_camera_v4l2_ioctl_t *ioctl_ptr = NULL;
		int rc = 0;

		if ((sd == NULL) \|\| (ioctl_ptr == NULL) \|\|
		(ioctl_ptr->ioctl_ptr == NULL)) {
		pr_err("Wrong ioctl_ptr %p, sd %p\n", ioctl_ptr, sd);
		if (sd == NULL) {
		pr_err("sd %p\n", sd);
		return -EINVAL;
		}
		cpp_dev = v4l2_get_subdevdata(sd);
		@@ -2517,6 +2540,11 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
		pr_err("cpp_dev is null\n");
		return -EINVAL;
		}
		rc = msm_cpp_validate_input(cmd, arg, &ioctl_ptr);
		if (rc != 0) {
		pr_err("input validation failed\n");
		return rc;
		}
		mutex_lock(&cpp_dev->mutex);
		CPP_DBG("E cmd: 0x%x\n", cmd);
		switch (cmd) {