Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

char: msm_smd_pkt: Fix the TIOCMSET IOCTL argument reading 

In the TIOCMSET IOCTL call the user passed argument is used
incorrectly to update the SMD channel DTR/CTS signals which
results in unexpected flow control on the SMD channel.

Use the get_user() API to get the user passed value and use the
same value to update SMD channel signals.

CRs-Fixed: 1036867
Change-Id: Ia814892a626b7a291d07ba3670e144f6f09fd41a
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
This commit is contained in:
Arun Kumar Neelakantam 2016-07-01 14:52:21 +05:30 committed by Gerrit - the friendly Code Review server
parent 944077f264
commit 27fa1e0e37
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/char/msm_smd_pkt.c
View File

@ -359,6 +359,7 @@ static long smd_pkt_ioctl(struct file *file, unsigned int cmd,
{
int ret;
struct smd_pkt_dev *smd_pkt_devp;
uint32_t val;
smd_pkt_devp = file->private_data;
if (!smd_pkt_devp)
@ -372,9 +373,15 @@ static long smd_pkt_ioctl(struct file *file, unsigned int cmd,
ret = smd_tiocmget(smd_pkt_devp->ch);
break;
case TIOCMSET:
D_STATUS("%s TIOCSET command on smd_pkt_dev id:%d\n",
__func__, smd_pkt_devp->i);
ret = smd_tiocmset(smd_pkt_devp->ch, arg, ~arg);
ret = get_user(val, (uint32_t *)arg);
if (ret) {
pr_err("Error getting TIOCMSET value\n");
mutex_unlock(&smd_pkt_devp->ch_lock);
return ret;
}
D_STATUS("%s TIOCSET command on smd_pkt_dev id:%d arg[0x%x]\n",
__func__, smd_pkt_devp->i, val);
ret = smd_tiocmset(smd_pkt_devp->ch, val, ~val);
break;
case SMD_PKT_IOCTL_BLOCKING_WRITE:
ret = get_user(smd_pkt_devp->blocking_write, (int *)arg);