Haibin Liu 6db1ad694f msm: sensor: actuator: avoid accessing out of bound memory ...

Issue:
When total_steps is updated, after that, copy_from_user
fails with an error, then, i2c_reg_tbl is not allocated.
In this case, when calling msm_actuator_parse_i2c_params,
it lead to out-of-bound memory write.

Fix:
1) Assign total_steps to zero when error from copying.
2) Add NULL pointer check for i2c tbl.

CRs-Fixed: 2111672
Change-Id: Ib9dcb182356e2df8078c131edfd0791fa95a35e0
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
[haggertk: Backport to 3.4/msm8974. Note that this includes patching
 the non-standard camera_ll implementation as well on this kernel.]
CVE-2017-15857
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-08 16:35:41 +02:00

..

common

…

dvb

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

isdbt

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

isdbtmm

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

mtv

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

platform

msm: sensor: actuator: avoid accessing out of bound memory

2019-08-08 16:35:41 +02:00

radio

radio: iris: Use kernel API to copy data from user space

2019-08-06 11:48:12 +02:00

rc

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

tdmb

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

video

uvcvideo: Prevent heap overflow in uvc driver

2019-08-08 16:03:03 +02:00

Kconfig

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

Makefile

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

media-device.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

media-devnode.c

…

media-entity.c

…