Skip to content

Commit ff7c91c

Browse files
Camera Software IntegrationGerrit - the friendly Code Review server
Camera Software Integration
authored and
Gerrit - the friendly Code Review server
committed
Merge "msm: camera: flash: Copy flash info to avoid TOCTOU" into camera-kernel.qclinux.1.0
2 parents eb05a30 + e4c7866 commit ff7c91c

2 files changed

Lines changed: 60 additions & 4 deletions

File tree

‎camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.c‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1312,6 +1312,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
13121312
struct cam_req_mgr_add_request add_req = {0};
13131313
struct cam_flash_init *cam_flash_info = NULL;
13141314
struct cam_flash_set_rer *flash_rer_info = NULL;
1315+
struct cam_flash_set_rer *flash_rer_info_u = NULL;
13151316
struct cam_flash_set_on_off *flash_operation_info = NULL;
13161317
struct cam_flash_set_on_off *flash_operation_info_u = NULL;
13171318
struct cam_flash_query_curr *flash_query_info = NULL;
@@ -1786,21 +1787,47 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
17861787
cam_mem_put_cpu_buf(config.packet_handle);
17871788
return rc;
17881789
}
1789-
flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
1790-
if (!flash_rer_info) {
1790+
flash_rer_info_u = (struct cam_flash_set_rer *)cmd_buf;
1791+
if (!flash_rer_info_u) {
17911792
CAM_ERR(CAM_FLASH,
17921793
"flash_rer_info Null");
17931794
rc = -EINVAL;
17941795
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
17951796
cam_mem_put_cpu_buf(config.packet_handle);
17961797
return rc;
17971798
}
1799+
1800+
count = flash_rer_info_u->count;
1801+
rc = cam_common_mem_kdup((void**)&flash_rer_info,
1802+
flash_rer_info_u,
1803+
sizeof(struct cam_flash_set_rer));
1804+
1805+
if(rc) {
1806+
CAM_ERR(CAM_FLASH, "Alloc and copy flash operation info failed");
1807+
break;
1808+
}
1809+
1810+
if (!flash_rer_info) {
1811+
CAM_ERR(CAM_FLASH, "Memory allocation for flash_rer_info failed");
1812+
rc = -ENOMEM;
1813+
break;
1814+
}
1815+
1816+
if (count != flash_rer_info->count) {
1817+
CAM_ERR(CAM_FLASH, "Count changed: userspace: %d, kernel: %d",
1818+
count, flash_rer_info->count);
1819+
rc = -EINVAL;
1820+
cam_common_mem_free(flash_rer_info);
1821+
break;
1822+
}
1823+
17981824
if (flash_rer_info->count >
17991825
CAM_FLASH_MAX_LED_TRIGGERS) {
18001826
CAM_ERR(CAM_FLASH, "led count out of limit");
18011827
rc = -EINVAL;
18021828
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
18031829
cam_mem_put_cpu_buf(config.packet_handle);
1830+
cam_common_mem_free(flash_rer_info);
18041831
return rc;
18051832
}
18061833

@@ -1826,6 +1853,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
18261853
rc);
18271854
cam_mem_put_cpu_buf(cmd_desc->mem_handle);
18281855
cam_mem_put_cpu_buf(config.packet_handle);
1856+
cam_common_mem_free(flash_rer_info);
18291857
return rc;
18301858
}
18311859
default:

‎camera_kt/drivers/cam_sensor_module/cam_flash/cam_flash_core.c‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1397,6 +1397,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
13971397
struct cam_req_mgr_add_request add_req = {0};
13981398
struct cam_flash_init *cam_flash_info = NULL;
13991399
struct cam_flash_set_rer *flash_rer_info = NULL;
1400+
struct cam_flash_set_rer *flash_rer_info_u = NULL;
14001401
struct cam_flash_set_on_off *flash_operation_info = NULL;
14011402
struct cam_flash_set_on_off *flash_operation_info_u = NULL;
14021403
struct cam_flash_query_curr *flash_query_info = NULL;
@@ -1824,16 +1825,42 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
18241825
rc = -EINVAL;
18251826
return rc;
18261827
}
1827-
flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
1828-
if (!flash_rer_info) {
1828+
flash_rer_info_u = (struct cam_flash_set_rer *)cmd_buf;
1829+
if (!flash_rer_info_u) {
18291830
CAM_ERR(CAM_FLASH,
18301831
"flash_rer_info Null");
18311832
rc = -EINVAL;
18321833
return rc;
18331834
}
1835+
1836+
count = flash_rer_info_u->count;
1837+
rc = cam_common_mem_kdup((void**)&flash_rer_info,
1838+
flash_rer_info_u,
1839+
sizeof(struct cam_flash_set_rer));
1840+
1841+
if(rc) {
1842+
CAM_ERR(CAM_FLASH, "Alloc and copy flash operation info failed");
1843+
break;
1844+
}
1845+
1846+
if (!flash_rer_info) {
1847+
CAM_ERR(CAM_FLASH, "Memory allocation for flash_rer_info failed");
1848+
rc = -ENOMEM;
1849+
break;
1850+
}
1851+
1852+
if (count != flash_rer_info->count) {
1853+
CAM_ERR(CAM_FLASH, "Count changed: userspace: %d, kernel: %d",
1854+
count, flash_rer_info->count);
1855+
rc = -EINVAL;
1856+
cam_common_mem_free(flash_rer_info);
1857+
break;
1858+
}
1859+
18341860
if (flash_rer_info->count >
18351861
CAM_FLASH_MAX_LED_TRIGGERS) {
18361862
CAM_ERR(CAM_FLASH, "led count out of limit");
1863+
cam_common_mem_free(flash_rer_info);
18371864
rc = -EINVAL;
18381865
return rc;
18391866
}
@@ -1858,6 +1885,7 @@ int cam_flash_pmic_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
18581885
if (rc)
18591886
CAM_ERR(CAM_FLASH, "apply_setting failed: %d",
18601887
rc);
1888+
cam_common_mem_free(flash_rer_info);
18611889
return rc;
18621890
}
18631891
default:

0 commit comments

Comments
 (0)