Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5cf2ebee authored by E V Ravi's avatar E V Ravi
Browse files

msm: ais: Fix arbitrary kernel write 



In 64 bit kernel and 32 bit userspace,ioctl_ptr from
kernel space, should NOT call the copy_from_user.
In 64 bit kernel and 64 bit userspace,ioctl_ptr from
user space, use the copy_from_user to copy data.
use the is_compat_task to distinguish two condition

Change-Id: I88fd0a3da8ceb2e707f8790d51fe5dd141a2cd2c
Signed-off-by: default avatarE V Ravi <evenka@codeaurora.org>
parent 83339054

drivers/media/platform/msm/ais/msm_buf_mgr/msm_generic_buf_mgr.c

+12 −11
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -527,7 +527,7 @@ static long msm_buf_mngr_subdev_ioctl(struct v4l2_subdev *sd, 
{

	int32_t rc = 0;

	struct msm_buf_mngr_device *buf_mngr_dev = v4l2_get_subdevdata(sd);

	void __user *argp = (void __user *)arg;

	void *argp = arg;



	if (!buf_mngr_dev) {

		pr_err("%s buf manager device NULL\n", __func__);
@@ -550,16 +550,17 @@ static long msm_buf_mngr_subdev_ioctl(struct v4l2_subdev *sd, 
				return -EINVAL;

			if (!k_ioctl.ioctl_ptr)

				return -EINVAL;



			MSM_CAM_GET_IOCTL_ARG_PTR(&tmp, &k_ioctl.ioctl_ptr,

				sizeof(tmp));

			if (copy_from_user(&buf_info, tmp,

			if (!is_compat_task()) {

				MSM_CAM_GET_IOCTL_ARG_PTR(&tmp,

					&k_ioctl.ioctl_ptr, sizeof(tmp));

				if (copy_from_user(&buf_info,

					(void __user *)tmp,

					sizeof(struct msm_buf_mngr_info))) {

					return -EFAULT;

				}

				k_ioctl.ioctl_ptr = (uintptr_t)&buf_info;



			argp = &k_ioctl;

			}

			argp = (void *)&k_ioctl;

			rc = msm_cam_buf_mgr_ops(cmd, argp);

			}

			break;

include/uapi/media/ais/msm_ais.h

+1 −1
Original line number Diff line number Diff line
@@ -218,7 +218,7 @@ struct msm_camera_private_ioctl_arg { 
	__u32 size;

	__u32 result;

	__u32 reserved;

	__user __u64 ioctl_ptr;

	__u64 ioctl_ptr;

};



#define VIDIOC_MSM_CAMERA_PRIVATE_IOCTL_CMD \