Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2025-08-03 20:04:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

Switch to new CVE patchset

Browse source
This commit is contained in:
Tad 2017-11-07 17:32:46 -05:00
parent 57ce42402b
commit 11c7037780
1215 changed files with 60697 additions and 14533 deletions
Download patch file Download diff file Expand all files Collapse all files

75
Patches/Linux_CVEs/CVE-2017-8239/ANY/0001.patch Normal file
View file

@ -0,0 +1,75 @@
From 01db0e012f86b8ba6974e5cb9905261a552a0610 Mon Sep 17 00:00:00 2001
From: Sureshnaidu Laveti <lsuresh@codeaurora.org>
Date: Thu, 15 Dec 2016 02:39:35 -0800
Subject: msm: sensor: validating the flash initialization parameters
Copying the flash initialization parameters from userspace memory to
kernel memory and in turn checking for the validity of the flash
initialization parameters pointer sent from userspace.
CRs-Fixed: 1091603
Change-Id: I17d57016c254fb6628844a152b0e7d45c0b23b2d
Signed-off-by: Sureshnaidu Laveti <lsuresh@codeaurora.org>
---
.../msm/camera_v2/sensor/flash/msm_flash.c | 38 +++++++++++++++++++++-
1 file changed, 37 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c
index ff0a0a5..71d3e61 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c
@@ -491,6 +491,42 @@ static int32_t msm_flash_init(
return 0;
}
+#ifdef CONFIG_COMPAT
+static int32_t msm_flash_init_prepare(
+ struct msm_flash_ctrl_t *flash_ctrl,
+ struct msm_flash_cfg_data_t *flash_data)
+{
+ return msm_flash_init(flash_ctrl, flash_data);
+}
+#else
+static int32_t msm_flash_init_prepare(
+ struct msm_flash_ctrl_t *flash_ctrl,
+ struct msm_flash_cfg_data_t *flash_data)
+{
+ struct msm_flash_cfg_data_t flash_data_k;
+ struct msm_flash_init_info_t flash_init_info;
+ int32_t i = 0;
+
+ flash_data_k.cfg_type = flash_data->cfg_type;
+ for (i = 0; i < MAX_LED_TRIGGERS; i++) {
+ flash_data_k.flash_current[i] =
+ flash_data->flash_current[i];
+ flash_data_k.flash_duration[i] =
+ flash_data->flash_duration[i];
+ }
+
+ flash_data_k.cfg.flash_init_info = &flash_init_info;
+ if (copy_from_user(&flash_init_info,
+ (void *)(flash_data->cfg.flash_init_info),
+ sizeof(struct msm_flash_init_info_t))) {
+ pr_err("%s copy_from_user failed %d\n",
+ __func__, __LINE__);
+ return -EFAULT;
+ }
+ return msm_flash_init(flash_ctrl, &flash_data_k);
+}
+#endif
+
static int32_t msm_flash_low(
struct msm_flash_ctrl_t *flash_ctrl,
struct msm_flash_cfg_data_t *flash_data)
@@ -592,7 +628,7 @@ static int32_t msm_flash_config(struct msm_flash_ctrl_t *flash_ctrl,
switch (flash_data->cfg_type) {
case CFG_FLASH_INIT:
- rc = msm_flash_init(flash_ctrl, flash_data);
+ rc = msm_flash_init_prepare(flash_ctrl, flash_data);
break;
case CFG_FLASH_RELEASE:
if (flash_ctrl->flash_state != MSM_CAMERA_FLASH_RELEASE) {
--
cgit v1.1