diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-05-11 06:48:03 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-05-11 06:48:03 -0700 |
| commit | 5633ac9b6cfbd2b989bdcd8fbc1ae6519e66c5ca (patch) | |
| tree | 6fe55ac505ab95508010cecbff129746bdab7ed8 | |
| parent | 6ce7c8ebb57f57efbcd85c1864d3960189a7fff1 (diff) | |
| parent | 50f424f032c5dce07bfae6a1ce83c28d16835e17 (diff) | |
Merge "msm: camera: Do not pass kptr in copy_from_user"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c b/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c index af6206f83048..f732f5180e81 100644 --- a/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c +++ b/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c @@ -540,20 +540,24 @@ static long msm_buf_mngr_subdev_ioctl(struct v4l2_subdev *sd, k_ioctl = *ptr; switch (k_ioctl.id) { case MSM_CAMERA_BUF_MNGR_IOCTL_ID_GET_BUF_BY_IDX: { - struct msm_buf_mngr_info buf_info, *tmp = NULL; if (k_ioctl.size != sizeof(struct msm_buf_mngr_info)) return -EINVAL; if (!k_ioctl.ioctl_ptr) return -EINVAL; - - MSM_CAM_GET_IOCTL_ARG_PTR(&tmp, &k_ioctl.ioctl_ptr, - sizeof(tmp)); - if (copy_from_user(&buf_info, tmp, - sizeof(struct msm_buf_mngr_info))) { - return -EFAULT; +#ifndef CONFIG_COMPAT + { + struct msm_buf_mngr_info buf_info, *tmp = NULL; + + MSM_CAM_GET_IOCTL_ARG_PTR(&tmp, + &k_ioctl.ioctl_ptr, sizeof(tmp)); + if (copy_from_user(&buf_info, tmp, + sizeof(struct msm_buf_mngr_info))) { + return -EFAULT; + } + k_ioctl.ioctl_ptr = (uintptr_t)&buf_info; } - k_ioctl.ioctl_ptr = (uintptr_t)&buf_info; +#endif argp = &k_ioctl; rc = msm_cam_buf_mgr_ops(cmd, argp); } @@ -674,6 +678,7 @@ static long msm_camera_buf_mgr_internal_compat_ioctl(struct file *file, return -EINVAL; } k_ioctl.ioctl_ptr = (__u64)&buf_info; + k_ioctl.size = sizeof(struct msm_buf_mngr_info); rc = msm_camera_buf_mgr_fetch_buf_info(&buf_info32, &buf_info, (unsigned long)tmp_compat_ioctl_ptr); if (rc < 0) { |