Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

Merge "radio: iris: Checking if driver's buffer is large enough."

This commit is contained in:
Linux Build Service Account 2013-11-21 01:43:06 -08:00 committed by Gerrit - the friendly Code Review server
parent abac47443d dce17fb362
commit fb45428116
1 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
drivers/media/radio/radio-iris.c
View File

@ -3914,18 +3914,35 @@ static int iris_vidioc_s_ctrl(struct file *file, void *priv,
radio->riva_data_req.cmd_params.start_addr = ctrl->value;
break;
case V4L2_CID_PRIVATE_IRIS_RIVA_ACCS_LEN:
radio->riva_data_req.cmd_params.length = ctrl->value;
if ((ctrl->value > 0) &&
(ctrl->value <= MAX_RIVA_PEEK_RSP_SIZE)) {
radio->riva_data_req.cmd_params.length = ctrl->value;
} else {
FMDERR("Length %d is more than the buffer size %d\n",
ctrl->value, MAX_RIVA_PEEK_RSP_SIZE);
retval = -EINVAL;
}
break;
case V4L2_CID_PRIVATE_IRIS_RIVA_POKE:
retval = copy_from_user(radio->riva_data_req.data,
if (radio->riva_data_req.cmd_params.length <=
MAX_RIVA_PEEK_RSP_SIZE) {
retval = copy_from_user(
radio->riva_data_req.data,
(void *)ctrl->value,
radio->riva_data_req.cmd_params.length);
if (retval != 0) {
retval = -retval;
break;
if (retval != 0) {
retval = -retval;
break;
}
radio->riva_data_req.cmd_params.subopcode =
RIVA_POKE_OPCODE;
retval = hci_poke_data(
&radio->riva_data_req,
radio->fm_hdev);
} else {
FMDERR("Can not copy into driver's buffer.\n");
retval = -EINVAL;
}
radio->riva_data_req.cmd_params.subopcode = RIVA_POKE_OPCODE;
retval = hci_poke_data(&radio->riva_data_req , radio->fm_hdev);
break;
case V4L2_CID_PRIVATE_IRIS_SSBI_ACCS_ADDR:
radio->ssbi_data_accs.start_addr = ctrl->value;