DivestOS/Patches/Linux_CVEs/CVE-2014-9890/0.patch

40 lines
1.5 KiB
Diff

From 14e0c8614d2715589583d8a95e33c422d110eb6f Mon Sep 17 00:00:00 2001
From: Rajesh Bondugula <rajeshb@codeaurora.org>
Date: Tue, 25 Jun 2013 17:45:23 -0700
Subject: msm: camera: Update CCI WR comamnd buffer size to 11 bytes
I2C command length is of 11 bytes, it includes 10 bytes of data and
1 byte of WR command. Use 11 bytes char array to create command.
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
Change-Id: I5292f238d612810a514b6a8bba9e70e07eb2627f
---
drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
index 61873d3..ddc3b57 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
@@ -181,7 +181,7 @@ static int32_t msm_cci_data_queue(struct cci_device *cci_dev,
uint16_t i = 0, j = 0, k = 0, h = 0, len = 0;
int32_t rc = 0;
uint32_t cmd = 0, delay = 0;
- uint8_t data[10];
+ uint8_t data[11];
uint16_t reg_addr = 0;
struct msm_camera_i2c_reg_setting *i2c_msg =
&c_ctrl->cfg.cci_i2c_write_cfg;
@@ -616,7 +616,7 @@ static int32_t msm_cci_i2c_write(struct v4l2_subdev *sd,
msm_cci_flush_queue(cci_dev, master);
goto ERROR;
} else {
- rc = 0;
+ rc = cci_dev->cci_master_info[master].status;
}
CDBG("%s:%d X wait_for_completion_interruptible\n", __func__,
__LINE__);
--
cgit v1.1