diff options
| author | Suman Anna <s-anna@ti.com> | 2012-05-17 00:16:20 -0500 |
|---|---|---|
| committer | Ziyan <jaraidaniel@gmail.com> | 2015-05-01 18:28:28 +0200 |
| commit | c9994649b7a5c84597f9d949fd54daf51dae3494 (patch) | |
| tree | e620399c7d0cbe42fbccd741b3dc5a652b4acefa /drivers/rpmsg | |
| parent | 26c539bfccf6be987fbdbcecc059a69e08c75890 (diff) | |
| download | kernel_samsung_tuna-c9994649b7a5c84597f9d949fd54daf51dae3494.zip kernel_samsung_tuna-c9994649b7a5c84597f9d949fd54daf51dae3494.tar.gz kernel_samsung_tuna-c9994649b7a5c84597f9d949fd54daf51dae3494.tar.bz2 | |
rpmsg: omx: fix copy_to_user in register/unregister ioctls
rpmsg: omx: fix copy_to_user in register/unregister ioctls
The ION fd registration and deregistration ioctls has the
arguments reversed in the copy_to_user() calls. The same
has been fixed.
Also included a minor additional case for returning a NULL
ION handle back to user-space.
Change-Id: I9d45957f9b913fa1775e70618f0da82e914a41d6
Signed-off-by: Tyler Luu <tluu@ti.com>
Signed-off-by: Suman Anna <s-anna@ti.com>
Diffstat (limited to 'drivers/rpmsg')
| -rw-r--r-- | drivers/rpmsg/rpmsg_omx.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/rpmsg/rpmsg_omx.c b/drivers/rpmsg/rpmsg_omx.c index ee7d5bb..dc51eee 100644 --- a/drivers/rpmsg/rpmsg_omx.c +++ b/drivers/rpmsg/rpmsg_omx.c @@ -390,6 +390,7 @@ long rpmsg_omx_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) case OMX_IOCIONREGISTER: { struct ion_fd_data data; + if (copy_from_user(&data, (char __user *) arg, sizeof(data))) { dev_err(omxserv->dev, "%s: %d: copy_from_user fail: %d\n", __func__, @@ -397,9 +398,9 @@ long rpmsg_omx_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) return -EFAULT; } data.handle = ion_import_fd(omx->ion_client, data.fd); - if (IS_ERR(data.handle)) + if (IS_ERR_OR_NULL(data.handle)) data.handle = NULL; - if (copy_to_user(&data, (char __user *) arg, sizeof(data))) { + if (copy_to_user((char __user *) arg, &data, sizeof(data))) { dev_err(omxserv->dev, "%s: %d: copy_to_user fail: %d\n", __func__, _IOC_NR(cmd), ret); @@ -410,6 +411,7 @@ long rpmsg_omx_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) case OMX_IOCIONUNREGISTER: { struct ion_fd_data data; + if (copy_from_user(&data, (char __user *) arg, sizeof(data))) { dev_err(omxserv->dev, "%s: %d: copy_from_user fail: %d\n", __func__, @@ -417,7 +419,7 @@ long rpmsg_omx_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) return -EFAULT; } ion_free(omx->ion_client, data.handle); - if (copy_to_user(&data, (char __user *) arg, sizeof(data))) { + if (copy_to_user((char __user *) arg, &data, sizeof(data))) { dev_err(omxserv->dev, "%s: %d: copy_to_user fail: %d\n", __func__, _IOC_NR(cmd), ret); |