A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 03:45:24 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel into android13-5.4-lahaina

Browse source 
"LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0"

* tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
  msm: camera: sensor: handling condition for random read
  msm: camera: icp: io buf config num validation
  msm: camera: ope: check cpu buffer offset and cmd buf idx

Change-Id: Id26854dd09597215befc5aaff1e5f6731a0fb3e0
This commit is contained in:
Michael Bestas 2024-10-01 11:20:01 +03:00 • committed by Alexander Winkowski
commit 475adf7cee
No known key found for this signature in database
GPG key ID: 72762A66704CDE44
3 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
techpack/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
View file

@ -4162,7 +4162,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet)
packet->io_configs_offset/4);
for (i = 0 ; i < packet->num_io_configs; i++)
if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)
if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT))
num_out_map_entries++;
if (num_out_map_entries <= CAM_MAX_OUT_RES) {
@ -4313,10 +4314,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr,
if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
sync_in_obj[j++] = io_cfg_ptr[i].fence;
prepare_args->num_in_map_entries++;
} else {
} else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) {
prepare_args->out_map_entries[k++].sync_id =
io_cfg_ptr[i].fence;
prepare_args->num_out_map_entries++;
} else {
CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u",
io_cfg_ptr[i].direction,
prepare_args->max_out_map_entries,
prepare_args->num_out_map_entries);
return -EINVAL;
}
CAM_DBG(CAM_REQ,
"ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",

12
techpack/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
View file

@ -2193,6 +2193,14 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
hw_mgr->iommu_hdl);
goto end;
}
if ((len <= frame_process->cmd_buf[i][j].offset) ||
(frame_process->cmd_buf[i][j].size <
frame_process->cmd_buf[i][j].length) ||
((len - frame_process->cmd_buf[i][j].offset) <
frame_process->cmd_buf[i][j].length)) {
CAM_ERR(CAM_OPE, "Invalid offset.");
return -EINVAL;
}
cpu_addr = cpu_addr +
frame_process->cmd_buf[i][j].offset;
CAM_DBG(CAM_OPE, "Hdl %x size %d len %d off %d",
@ -2241,6 +2249,10 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
uint32_t s_idx = 0;
s_idx = cmd_buf->stripe_idx;
if (s_idx < 0 || s_idx >= OPE_MAX_STRIPES) {
CAM_ERR(CAM_OPE, "Invalid index.");
return -EINVAL;
}
num_cmd_bufs =
ope_request->num_stripe_cmd_bufs[i][s_idx];

10
techpack/camera/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
View file

@ -395,10 +395,11 @@ static int32_t cam_sensor_handle_random_read(
struct cam_buf_io_cfg *io_cfg)
{
struct i2c_settings_list *i2c_list;
int32_t rc = 0, cnt = 0;
int32_t rc = 0, cnt = 0, payload_count = 0;
payload_count = cmd_i2c_random_rd->header.count;
i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings,
cmd_i2c_random_rd->header.count);
payload_count);
if ((i2c_list == NULL) ||
(i2c_list->i2c_settings.reg_setting == NULL)) {
CAM_ERR(CAM_SENSOR,
@ -413,7 +414,7 @@ static int32_t cam_sensor_handle_random_read(
} else {
*cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) +
(sizeof(struct cam_cmd_read) *
(cmd_i2c_random_rd->header.count));
payload_count);
i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM;
i2c_list->i2c_settings.addr_type =
cmd_i2c_random_rd->header.addr_type;
@ -422,8 +423,7 @@ static int32_t cam_sensor_handle_random_read(
i2c_list->i2c_settings.size =
cmd_i2c_random_rd->header.count;
for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count);
cnt++) {
for (cnt = 0; cnt < payload_count; cnt++) {
i2c_list->i2c_settings.reg_setting[cnt].reg_addr =
cmd_i2c_random_rd->data_read[cnt].reg_data;
}