From d1e31dec5a9375bb595cf13a8e78a6f0d3fde329 Mon Sep 17 00:00:00 2001 From: Swami Reddy Reddy Date: Wed, 24 Jul 2024 18:53:36 +0530 Subject: [PATCH] msm: camera: sensor: TOCTOU error handling - Proper Handling in case of invalid pinctrl index - Removing dead code and unused variables - Change to dereference s_ctrl only after proper NULL Dereference Check. CRs-Fixed: 3875406 Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da Signed-off-by: Swami Reddy Reddy --- drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c | 13 ++++++++----- .../cam_sensor_module/cam_sensor/cam_sensor_core.c | 5 +++-- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c b/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c index 5165f6b2d1c9..146967f076a9 100644 --- a/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c +++ b/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -379,7 +380,7 @@ static int cam_res_mgr_shared_pinctrl_select_state( cam_res->pctrl_res[idx].pstatus = PINCTRL_STATUS_SUSPEND; } - return 0; + return rc; } static int cam_res_mgr_add_device(struct device *dev, @@ -577,11 +578,9 @@ static void cam_res_mgr_gpio_free(struct device *dev, uint gpio) bool need_free = true; int dev_num = 0; struct cam_gpio_res *gpio_res = NULL; - bool is_shared_gpio = false; bool is_shared_pctrl_gpio = false; int pctrl_idx = -1; - is_shared_gpio = cam_res_mgr_gpio_is_in_shared_gpio(gpio); is_shared_pctrl_gpio = cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio); @@ -634,8 +633,12 @@ static void cam_res_mgr_gpio_free(struct device *dev, uint gpio) pctrl_idx = cam_res_mgr_util_get_idx_from_shared_pctrl_gpio( gpio); - cam_res_mgr_shared_pinctrl_select_state( - pctrl_idx, false); + if (pctrl_idx >= 0) { + cam_res_mgr_shared_pinctrl_select_state( + pctrl_idx, false); + } else { + CAM_ERR(CAM_RES, "invalid pinctrl idx: %d", pctrl_idx); + } } CAM_DBG(CAM_RES, "freeing gpio: %u", gpio); diff --git a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c index 999fec038324..a31023e4101c 100644 --- a/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c +++ b/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c @@ -719,13 +719,14 @@ int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl, { int rc = 0, pkt_opcode = 0; struct cam_control *cmd = (struct cam_control *)arg; - struct cam_sensor_power_ctrl_t *power_info = - &s_ctrl->sensordata->power_info; + struct cam_sensor_power_ctrl_t *power_info = NULL; if (!s_ctrl || !arg) { CAM_ERR(CAM_SENSOR, "s_ctrl is NULL"); return -EINVAL; } + power_info = &s_ctrl->sensordata->power_info; + if (cmd->op_code != CAM_SENSOR_PROBE_CMD) { if (cmd->handle_type != CAM_HANDLE_USER_POINTER) { CAM_ERR(CAM_SENSOR, "Invalid handle type: %d",