Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a4f50d4 authored by Terence Ho's avatar Terence Ho
Browse files

msm: camera: fix untrusted pointer for power down setting 



When getting power down setting, there is an untrusted pointer
from a user space pointer.Need to copy to the kernel space first.

Change-Id: I0c66e942453581caac5ea00a54a252840a32972f
CRs-Fixed: 2037398 2037403
Signed-off-by: default avatarTerence Ho <terenceh@codeaurora.org>
parent e539a094

drivers/media/platform/msm/ais/sensor/msm_sensor_driver.c

+5 −11
Original line number Diff line number Diff line
@@ -412,17 +412,11 @@ static int32_t msm_sensor_create_pd_settings(void *setting, 


#ifdef CONFIG_COMPAT

	if (is_compat_task()) {

		int i = 0;

		struct msm_sensor_power_setting32 *power_setting_iter =

		(struct msm_sensor_power_setting32 *)compat_ptr((

		(struct msm_camera_sensor_slave_info32 *)setting)->

		power_setting_array.power_setting);



		for (i = 0; i < size_down; i++) {

			pd[i].config_val = power_setting_iter[i].config_val;

			pd[i].delay = power_setting_iter[i].delay;

			pd[i].seq_type = power_setting_iter[i].seq_type;

			pd[i].seq_val = power_setting_iter[i].seq_val;

		rc = msm_sensor_get_pw_settings_compat(

			pd, pu, size_down);

		if (rc < 0) {

			pr_err("failed");

			return -EFAULT;

		}

	} else

#endif