summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFrank Chen <frankc@nvidia.com>2016-03-21 10:40:45 -0700
committerMatthew Pedro <mapedro@nvidia.com>2016-05-20 10:59:11 -0700
commit1275778d6d510a62c884afc7494bd7cd055855ee (patch)
treed9788e2c51eeb9fa50525459188054d0f2242229
parent14359cb871606ffefa4ca2070b7e9ccb08dcd378 (diff)
camera: tegra: Fix security vulnerability issue
We need to validate power on/off function size passed in from user mode in order to avoid integer overflow or out of memory failures. Bug 1745100 Change-Id: Idddd848f7dc1e864559ad219f9204325128484e5 Signed-off-by: Frank Chen <frankc@nvidia.com> Signed-off-by: Bibek Basu <bbasu@nvidia.com> Reviewed-on: http://git-master/r/1114354 (cherry picked from commit 8b3afcc132882f3102083f9a24de7f55476ca59b) Reviewed-on: http://git-master/r/1150944 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
-rw-r--r--drivers/media/platform/tegra/cam_dev/virtual.c14
-rw-r--r--include/media/camera.h4
2 files changed, 15 insertions, 3 deletions
diff --git a/drivers/media/platform/tegra/cam_dev/virtual.c b/drivers/media/platform/tegra/cam_dev/virtual.c
index e151068fa377..5484d32205aa 100644
--- a/drivers/media/platform/tegra/cam_dev/virtual.c
+++ b/drivers/media/platform/tegra/cam_dev/virtual.c
@@ -1,7 +1,7 @@
/*
* virtual.c - Virtual kernel driver
*
- * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2013-2016, NVIDIA CORPORATION. All rights reserved.
* This program is free software; you can redistribute it and/or modify it
* under the terms and conditions of the GNU General Public License,
@@ -354,6 +354,18 @@ static int virtual_device_sanity_check(
}
dev_dbg(dev, "regulator name size: %d\n", *len);
+ if (dev_info->pwr_on_size > VIRTUAL_DEV_MAX_POWER_SIZE) {
+ dev_err(dev, "%s power on function size too big %d!\n",
+ __func__, dev_info->pwr_on_size);
+ return -ENODEV;
+ }
+
+ if (dev_info->pwr_off_size > VIRTUAL_DEV_MAX_POWER_SIZE) {
+ dev_err(dev, "%s power off function size too big %d!\n",
+ __func__, dev_info->pwr_off_size);
+ return -ENODEV;
+ }
+
return 0;
}
diff --git a/include/media/camera.h b/include/media/camera.h
index 568378476fd6..5cbac56de269 100644
--- a/include/media/camera.h
+++ b/include/media/camera.h
@@ -1,6 +1,5 @@
/*
- * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved.
-
+ * Copyright (c) 2013-2016, NVIDIA CORPORATION. All rights reserved.
* This program is free software; you can redistribute it and/or modify it
* under the terms and conditions of the GNU General Public License,
* version 2, as published by the Free Software Foundation.
@@ -164,6 +163,7 @@ struct edp_cfg {
#define VIRTUAL_DEV_MAX_REGULATORS 8
#define VIRTUAL_DEV_MAX_GPIOS 8
+#define VIRTUAL_DEV_MAX_POWER_SIZE 32
#define VIRTUAL_REGNAME_SIZE (VIRTUAL_DEV_MAX_REGULATORS * \
CAMERA_MAX_NAME_LENGTH)
#ifdef CONFIG_COMPAT