Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7bf23ce7 authored by Sunid Wilson's avatar Sunid Wilson Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: cpp: Add validation for v4l2 ioctl arguments 



In CPP v4l2 ioctl command is made, if _IOC_DIR(cmd) is
_IOC_NONE, then the user-supplied argument arg is not checked
and an information disclosure is possible

CRs-Fixed: 1042068
Change-Id: Iddb291b10cdcb5c42ab8497e06c2ce47885cd5ab
Signed-off-by: default avatarSunid Wilson <sunidw@codeaurora.org>
parent 8e2a844b

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+9 −3
Original line number Diff line number Diff line
@@ -2678,14 +2678,14 @@ static int msm_cpp_validate_input(unsigned int cmd, void *arg, 
		break;

	default: {

		if (ioctl_ptr == NULL) {

			pr_err("Wrong ioctl_ptr %pK\n", ioctl_ptr);

			pr_err("Wrong ioctl_ptr for cmd %u\n", cmd);

			return -EINVAL;

		}



		*ioctl_ptr = arg;

		if ((*ioctl_ptr == NULL) ||

			((*ioctl_ptr)->ioctl_ptr == NULL)) {

			pr_err("Wrong arg %pK\n", arg);

			(*ioctl_ptr)->ioctl_ptr == NULL) {

			pr_err("Error invalid ioctl argument cmd %u", cmd);

			return -EINVAL;

		}

		break;
@@ -2710,6 +2710,12 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, 
		pr_err("cpp_dev is null\n");

		return -EINVAL;

	}



	if (_IOC_DIR(cmd) == _IOC_NONE) {

		pr_err("Invalid ioctl/subdev cmd %u", cmd);

		return -EINVAL;

	}



	rc = msm_cpp_validate_input(cmd, arg, &ioctl_ptr);

	if (rc != 0) {

		pr_err("input validation failed\n");