Skip to content

Commit

Permalink
msm: camera: cpp: Add validation for v4l2 ioctl arguments
Browse files Browse the repository at this point in the history
In CPP v4l2 ioctl command is made, if _IOC_DIR(cmd) is
_IOC_NONE, then the user-supplied argument arg is not checked
and an information disclosure is possible
CRs-Fixed: 1042068

Change-Id: Iddb291b10cdcb5c42ab8497e06c2ce47885cd5ab
Signed-off-by: Suman Mukherjee <sumam@codeaurora.org>
Signed-off-by: Sunid Wilson <sunidw@codeaurora.org>
  • Loading branch information
Suman Mukherjee authored and mdmower committed Dec 17, 2016
1 parent 7a0c2d5 commit c02d5c3
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
Expand Up @@ -1537,7 +1537,10 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
pr_err("cpp_dev is null\n");
return -EINVAL;
}

if (_IOC_DIR(cmd) == _IOC_NONE) {
pr_err("Invalid ioctl/subdev cmd %u", cmd);
return -EINVAL;
}
if ((ioctl_ptr->ioctl_ptr == NULL) || (ioctl_ptr->len == 0)) {
pr_err("ioctl_ptr OR ioctl_ptr->len is NULL %p %d\n",
ioctl_ptr, ioctl_ptr->len);
Expand Down

0 comments on commit c02d5c3

Please sign in to comment.