From f8ae162dec5cb0603e7df024c16296a82199cf88 Mon Sep 17 00:00:00 2001 From: Sumalatha Malothu Date: Mon, 29 Apr 2019 18:05:53 +0530 Subject: [PATCH] msm: camera_v2: handle the error value returned during get clock currently only NULL pointer check is used to validate the return value from clk_get, this change to handle all the failures. This snapshot is taken from msm-4.9 Ported it from 4.9 to 3.18 Change-Id: Icd8b7e33d0f235a7c5dde2307972a594908e6a60 Signed-off-by: Sumalatha Malothu [haggertk: Backport to 3.4/msm8974. Note that this includes patching the non-standard camera_ll implementation as well on this kernel.] CVE-2019-10524 Signed-off-by: Kevin F. Haggerty --- .../platform/msm/camera_v2/sensor/io/msm_camera_io_util.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_io_util.c b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_io_util.c index e9204c7b0b1..ca5de430dba 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_io_util.c +++ b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_io_util.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2013, The Linux Foundataion. All rights reserved. +/* Copyright (c) 2011-2013, 2019 The Linux Foundataion. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -183,12 +183,13 @@ int msm_cam_clk_enable(struct device *dev, struct msm_cam_clk_info *clk_info, } } else { for (i = num_clk - 1; i >= 0; i--) { - if (clk_ptr[i] != NULL) { + if (!IS_ERR_OR_NULL(clk_ptr[i])) { CDBG("%s disable %s\n", __func__, clk_info[i].clk_name); clk_disable(clk_ptr[i]); clk_unprepare(clk_ptr[i]); clk_put(clk_ptr[i]); + clk_ptr[i] = NULL; } } } @@ -202,10 +203,11 @@ cam_clk_set_err: clk_put(clk_ptr[i]); cam_clk_get_err: for (i--; i >= 0; i--) { - if (clk_ptr[i] != NULL) { + if (!IS_ERR_OR_NULL(clk_ptr[i])) { clk_disable(clk_ptr[i]); clk_unprepare(clk_ptr[i]); clk_put(clk_ptr[i]); + clk_ptr[i] = NULL; } } return rc;