Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75894f13 authored by Arun Kumar Neelakantam's avatar Arun Kumar Neelakantam
Browse files

char: msm_smd_pkt: Fix the TIOCMSET IOCTL argument reading 



In the TIOCMSET IOCTL call the user passed argument is used
incorrectly to update the SMD channel DTR/CTS signals which
results in unexpected flow control on the SMD channel.

Use the get_user() API to get the user passed value and use the
same value to update SMD channel signals.

CRs-Fixed: 1036867
Change-Id: Ia814892a626b7a291d07ba3670e144f6f09fd41a
Signed-off-by: default avatarArun Kumar Neelakantam <aneela@codeaurora.org>
parent 05a0c86d

drivers/char/msm_smd_pkt.c

+10 −3
Original line number Diff line number Diff line
@@ -349,6 +349,7 @@ static long smd_pkt_ioctl(struct file *file, unsigned int cmd, 
{

	int ret;

	struct smd_pkt_dev *smd_pkt_devp;

	uint32_t val;



	smd_pkt_devp = file->private_data;

	if (!smd_pkt_devp)
@@ -362,9 +363,15 @@ static long smd_pkt_ioctl(struct file *file, unsigned int cmd, 
		ret = smd_tiocmget(smd_pkt_devp->ch);

		break;

	case TIOCMSET:

		D_STATUS("%s TIOCSET command on smd_pkt_dev id:%d\n",

			 __func__, smd_pkt_devp->i);

		ret = smd_tiocmset(smd_pkt_devp->ch, arg, ~arg);

		ret = get_user(val, (uint32_t *)arg);

		if (ret) {

			pr_err("Error getting TIOCMSET value\n");

			mutex_unlock(&smd_pkt_devp->ch_lock);

			return ret;

		}

		D_STATUS("%s TIOCSET command on smd_pkt_dev id:%d arg[0x%x]\n",

			 __func__, smd_pkt_devp->i, val);

		ret = smd_tiocmset(smd_pkt_devp->ch, val, ~val);

		break;

	case SMD_PKT_IOCTL_BLOCKING_WRITE:

		ret = get_user(smd_pkt_devp->blocking_write, (int *)arg);