Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f9e9539 authored by Rajakumar Govindaram's avatar Rajakumar Govindaram Committed by Matt Wagantall
Browse files

msm: camera2: cpp: Support VIDIOC_MSM_CPP_POP_STREAM_BUFFER compat mode 



The 32-bit / 64-bit compat mode support needs to be extended for
VIDIOC_MSM_CPP_POP_STREAM_BUFFER. This will result in invalid size of
data being copied from kernel to user.

Change-Id: I1a7ed3b2d14db27506dea4b90eab356a804e7b7d
Signed-off-by: default avatarRajakumar Govindaram <rajakuma@codeaurora.org>
parent 0669848b

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+22 −3
Original line number Diff line number Diff line
@@ -2753,13 +2753,13 @@ STREAM_BUFF_END: 
			rc = -EINVAL;

			break;

		}

		rc = (copy_from_user(&frame_info,

			(void __user *)ioctl_ptr->ioctl_ptr,

			sizeof(struct msm_cpp_frame_info_t)) ? -EFAULT : 0);



		rc = msm_cpp_copy_from_ioctl_ptr(&frame_info, ioctl_ptr);

		if (rc) {

			ERR_COPY_FROM_USER();

			break;

		}



		memset(&buff_mgr_info, 0, sizeof(struct msm_buf_mngr_info));

		buff_mgr_info.session_id =

			((frame_info.identity >> 16) & 0xFFFF);
@@ -3131,6 +3131,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
	struct msm_cpp_clock_settings_t clock_settings;

	struct msm_pproc_queue_buf_info k_queue_buf;

	struct msm_cpp_stream_buff_info_t k_cpp_buff_info;

	struct msm_cpp_frame_info32_t k32_frame_info;

	struct msm_cpp_frame_info_t k64_frame_info;

	void __user *up = (void __user *)arg;



	if (sd == NULL) {
@@ -3384,8 +3386,25 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, 
		break;

	}

	case VIDIOC_MSM_CPP_POP_STREAM_BUFFER32:

	{

		if (kp_ioctl.len != sizeof(struct msm_cpp_frame_info32_t))

			return -EINVAL;

		else

			kp_ioctl.len = sizeof(struct msm_cpp_frame_info_t);



		if (copy_from_user(&k32_frame_info,

			(void __user *)kp_ioctl.ioctl_ptr,

			sizeof(k32_frame_info)))

			return -EFAULT;



		memset(&k64_frame_info, 0, sizeof(k64_frame_info));

		k64_frame_info.identity = k32_frame_info.identity;

		k64_frame_info.frame_id = k32_frame_info.frame_id;



		kp_ioctl.ioctl_ptr = (void *)&k64_frame_info;

		cmd = VIDIOC_MSM_CPP_POP_STREAM_BUFFER;

		break;

	}

	case VIDIOC_MSM_CPP_IOMMU_ATTACH32:

		cmd = VIDIOC_MSM_CPP_IOMMU_ATTACH;

		break;