Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b66ddad9 authored by Haibin Liu's avatar Haibin Liu Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: fix untrusted pointer for power down setting 



When getting power down setting, there is an untrusted pointer
from a user space pointer. Need to copy to the kernel space first.

CRs-Fixed: 2037398
Change-Id: I64032a96e62ddfeec85eebe984d8ba52754f6148
Signed-off-by: default avatarHaibin Liu <haibinl@codeaurora.org>
parent c6b2aed4

drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c

+5 −11
Original line number Original line Diff line number Diff line
@@ -426,17 +426,11 @@ static int32_t msm_sensor_create_pd_settings(void *setting, 




#ifdef CONFIG_COMPAT

#ifdef CONFIG_COMPAT

	if (is_compat_task()) {

	if (is_compat_task()) {

		int i = 0;

		rc = msm_sensor_get_pw_settings_compat(

		struct msm_sensor_power_setting32 *power_setting_iter =

			pd, pu, size_down);

		(struct msm_sensor_power_setting32 *)compat_ptr((

		if (rc < 0) {

		(struct msm_camera_sensor_slave_info32 *)setting)->

			pr_err("failed");

		power_setting_array.power_setting);

			return -EFAULT;



		for (i = 0; i < size_down; i++) {

			pd[i].config_val = power_setting_iter[i].config_val;

			pd[i].delay = power_setting_iter[i].delay;

			pd[i].seq_type = power_setting_iter[i].seq_type;

			pd[i].seq_val = power_setting_iter[i].seq_val;

		}

		}

	} else

	} else

#endif

#endif