Merge "msm: camera: cpp: Avoid exposing kernel information to user space" (b796cd9d) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+19 −10

Original line number	Diff line number	Diff line
		/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -3666,6 +3666,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		struct msm_cpp_frame_info32_t k32_frame_info;
		struct msm_cpp_frame_info_t k64_frame_info;
		uint32_t identity_k = 0;
		bool is_copytouser_req = true;
		void __user up = (void __user )arg;

		if (sd == NULL) {
		@@ -3799,9 +3800,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		break;
		}
		}
		if (copy_to_user(
		(void __user *)kp_ioctl.ioctl_ptr, &inst_info,
		sizeof(struct msm_cpp_frame_info32_t))) {
		if (copy_to_user((void __user *)kp_ioctl.ioctl_ptr,
		&inst_info, sizeof(struct msm_cpp_frame_info32_t))) {
		mutex_unlock(&cpp_dev->mutex);
		return -EFAULT;
		}
		@@ -3837,6 +3837,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		sizeof(struct msm_cpp_stream_buff_info_t);
		}
		}
		is_copytouser_req = false;
		if (cmd == VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO32)
		cmd = VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO;
		else if (cmd == VIDIOC_MSM_CPP_DELETE_STREAM_BUFF32)
		@@ -3851,6 +3852,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		get_user(identity_k, identity_u);
		kp_ioctl.ioctl_ptr = (void *)&identity_k;
		kp_ioctl.len = sizeof(uint32_t);
		is_copytouser_req = false;
		cmd = VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO;
		break;
		}
		@@ -3909,6 +3911,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		sizeof(struct msm_cpp_clock_settings_t);
		}
		}
		is_copytouser_req = false;
		cmd = VIDIOC_MSM_CPP_SET_CLOCK;
		break;
		}
		@@ -3934,6 +3937,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,

		kp_ioctl.ioctl_ptr = (void *)&k_queue_buf;
		kp_ioctl.len = sizeof(struct msm_pproc_queue_buf_info);
		is_copytouser_req = false;
		cmd = VIDIOC_MSM_CPP_QUEUE_BUF;
		break;
		}
		@@ -3958,6 +3962,8 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		k64_frame_info.frame_id = k32_frame_info.frame_id;

		kp_ioctl.ioctl_ptr = (void *)&k64_frame_info;

		is_copytouser_req = false;
		cmd = VIDIOC_MSM_CPP_POP_STREAM_BUFFER;
		break;
		}
		@@ -4011,13 +4017,16 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file,
		break;
		}

		if (is_copytouser_req) {
		up32_ioctl.id = kp_ioctl.id;
		up32_ioctl.len = kp_ioctl.len;
		up32_ioctl.trans_code = kp_ioctl.trans_code;
		up32_ioctl.ioctl_ptr = ptr_to_compat(kp_ioctl.ioctl_ptr);

		if (copy_to_user((void __user *)up, &up32_ioctl, sizeof(up32_ioctl)))
		if (copy_to_user((void __user *)up, &up32_ioctl,
		sizeof(up32_ioctl)))
		return -EFAULT;
		}

		return rc;
		}