Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a3c4a45 authored by Alok's avatar Alok Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Bug fix in IR LED Driver 



If camera daemon dies, kernel crash is observed due to stack corruption
in IR LED driver. When camera daemon dies, IR LED driver receives shutdown
IOCTL. Here the IR LED driver is accessing a structure object beyond its
limit.
The code is modified to access the structure object within its limit.

Change-Id: Ieb75e168dc412489da1baaa59546a6548b98b35e
Signed-off-by: default avatarAlok <akumarpa@codeaurora.org>
parent c8234f7c

drivers/media/platform/msm/camera_v2/sensor/ir_led/msm_ir_led.c

+2 −3
Original line number Diff line number Diff line
@@ -242,7 +242,7 @@ static long msm_ir_led_subdev_ioctl(struct v4l2_subdev *sd, 
{

	struct msm_ir_led_ctrl_t *fctrl = NULL;

	void __user *argp = (void __user *)arg;

	struct msm_ir_led_cfg_data_t *ir_led_data;

	struct msm_ir_led_cfg_data_t ir_led_data = {0};



	if (!sd) {

		pr_err(" v4l2 ir led subdevice is NULL\n");
@@ -261,13 +261,12 @@ static long msm_ir_led_subdev_ioctl(struct v4l2_subdev *sd, 
	case MSM_SD_NOTIFY_FREEZE:

		return 0;

	case MSM_SD_SHUTDOWN:

		ir_led_data = (struct msm_ir_led_cfg_data_t *)argp;

		if (!fctrl->func_tbl) {

			pr_err("No call back funcions\n");

			return -EINVAL;

		} else {

			return fctrl->func_tbl->camera_ir_led_release(fctrl,

							ir_led_data);

							&ir_led_data);

		}

	default:

		pr_err_ratelimited("invalid cmd %d\n", cmd);