diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2016-12-01 16:39:35 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-12-01 16:39:34 -0800 |
| commit | 60297d105f662b6a261deba57f9dd1cf9e72bb0f (patch) | |
| tree | 6b1d943dba4dc89a1a85acdff72e839d2f3da9b1 | |
| parent | 689f29df32cdd7546af6b4137a1a7aee0967311e (diff) | |
| parent | 42082eae98931aaa7bda1f1ccd413f0afd904c37 (diff) | |
Merge "msm: camera: jpegdma: Check for compat config"
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c b/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c index 63d7e715162b..3301fc446193 100644 --- a/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c +++ b/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_dev.c @@ -128,6 +128,21 @@ static inline void msm_jpegdma_schedule_next_config(struct jpegdma_ctx *ctx) } /* + * msm_jpegdma_cast_long_to_buff_ptr - Cast long to buffer pointer. + * @vaddr: vaddr as long + * @buff_ptr_head: buffer pointer head + */ +static inline void msm_jpegdma_cast_long_to_buff_ptr(unsigned long vaddr, + struct msm_jpeg_dma_buff **buff_ptr_head) +{ +#ifdef CONFIG_COMPAT + *buff_ptr_head = compat_ptr(vaddr); +#else + *buff_ptr_head = (struct msm_jpeg_dma_buff *) vaddr; +#endif +} + +/* * msm_jpegdma_get_format_idx - Get jpeg dma format lookup index. * @ctx: Pointer to dma ctx. * @f: v4l2 format. @@ -410,10 +425,12 @@ static void *msm_jpegdma_get_userptr(void *alloc_ctx, { struct msm_jpegdma_device *dma = alloc_ctx; struct msm_jpegdma_buf_handle *buf; - struct msm_jpeg_dma_buff __user *up_buff = compat_ptr(vaddr); + struct msm_jpeg_dma_buff __user *up_buff; struct msm_jpeg_dma_buff kp_buff; int ret; + msm_jpegdma_cast_long_to_buff_ptr(vaddr, &up_buff); + if (!access_ok(VERIFY_READ, up_buff, sizeof(struct msm_jpeg_dma_buff)) || get_user(kp_buff.fd, &up_buff->fd)) { @@ -813,10 +830,12 @@ static int msm_jpegdma_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf) { struct jpegdma_ctx *ctx = msm_jpegdma_ctx_from_fh(fh); - struct msm_jpeg_dma_buff __user *up_buff = compat_ptr(buf->m.userptr); + struct msm_jpeg_dma_buff __user *up_buff; struct msm_jpeg_dma_buff kp_buff; int ret; + msm_jpegdma_cast_long_to_buff_ptr(buf->m.userptr, &up_buff); + if (!access_ok(VERIFY_READ, up_buff, sizeof(struct msm_jpeg_dma_buff)) || get_user(kp_buff.fd, &up_buff->fd) || |