A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: camera: reqmgr: check if link handle is correctly passed

Browse source 
Instead of the link handle if the dev handle is
passed for dumping the request information, this
can lead to accessing invalid data structure.
To avodi accessing invalid data structure based on
the dev handle, first check if the link handle passed
in IOCTL is matchting with looked up link handle.

CRs-Fixed: 3097336
Change-Id: I815457ff96e3b26fe9fa886bd984d53d209e4edb
Signed-off-by: Tejas Prajapati <[email protected]>
This commit is contained in:
Tejas Prajapati 2021-12-20 14:44:36 +05:30
commit 4856f7a40a
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/cam_req_mgr/cam_req_mgr_core.c
View file

@ -4542,7 +4542,7 @@ int cam_req_mgr_dump_request(struct cam_dump_req_cmd *dump_req)
link = (struct cam_req_mgr_core_link *)
cam_get_device_priv(dump_req->link_hdl);
if (!link) {
if (!link || link->link_hdl != dump_req->link_hdl) {
CAM_DBG(CAM_CRM, "link ptr NULL %x", dump_req->link_hdl);
rc = -EINVAL;
goto end;