DivestOS/Patches/Linux_CVEs/CVE-2017-11029/3.18/0001.patch
2017-11-07 21:38:42 -05:00

44 lines
1.4 KiB
Diff

From 74ab23917b82769644a3299da47b58e080aa63f2 Mon Sep 17 00:00:00 2001
From: Terence Ho <terenceh@codeaurora.org>
Date: Fri, 26 May 2017 15:05:07 -0400
Subject: msm: ais: cpp fix to check zero length ioctl
Port of ioctl validation for zero length ioctl
from camera_v2.
Change-Id: I635522f331d1e18641196ee3101c64ccc285636a
CRs-fixed: 2025367
Signed-off-by: Terence Ho <terenceh@codeaurora.org>
---
drivers/media/platform/msm/ais/pproc/cpp/msm_cpp.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/msm/ais/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/ais/pproc/cpp/msm_cpp.c
index 0e1c6b4..d265210 100644
--- a/drivers/media/platform/msm/ais/pproc/cpp/msm_cpp.c
+++ b/drivers/media/platform/msm/ais/pproc/cpp/msm_cpp.c
@@ -2889,6 +2889,8 @@ static int msm_cpp_validate_ioctl_input(unsigned int cmd, void *arg,
case MSM_SD_SHUTDOWN:
case MSM_SD_NOTIFY_FREEZE:
case MSM_SD_UNNOTIFY_FREEZE:
+ case VIDIOC_MSM_CPP_IOMMU_ATTACH:
+ case VIDIOC_MSM_CPP_IOMMU_DETACH:
break;
default: {
if (ioctl_ptr == NULL) {
@@ -2897,8 +2899,9 @@ static int msm_cpp_validate_ioctl_input(unsigned int cmd, void *arg,
}
*ioctl_ptr = arg;
- if ((*ioctl_ptr == NULL) ||
- (*ioctl_ptr)->ioctl_ptr == NULL) {
+ if (((*ioctl_ptr) == NULL) ||
+ ((*ioctl_ptr)->ioctl_ptr == NULL) ||
+ ((*ioctl_ptr)->len == 0)) {
pr_err("Error invalid ioctl argument cmd %u", cmd);
return -EINVAL;
}
--
cgit v1.1