From 1a1947c8961a7ee2bc020991b0f4d708d32fcc4a Mon Sep 17 00:00:00 2001 From: jinguiw Date: Thu, 11 Jul 2024 18:03:15 +0530 Subject: [PATCH 1/3] msm: camera: ope: check cpu buffer offset and cmd buf idx No check for cpu buffer offset, which may lead to out of cpu buffer map. No check for cmd buffer index, which may lead to out of bound or negative index. Adding check for cpu buffer map offset and adding check for cmd buffer index. CRs-Fixed: 3864084 Change-Id: I39494b0a9f323cb5569d37a0c033b2eaf8fbd32c Signed-off-by: jinguiw --- drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c index 64ed8f360348..31cad8f760a8 100644 --- a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c +++ b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c @@ -2192,6 +2192,14 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr, hw_mgr->iommu_hdl); goto end; } + if ((len <= frame_process->cmd_buf[i][j].offset) || + (frame_process->cmd_buf[i][j].size < + frame_process->cmd_buf[i][j].length) || + ((len - frame_process->cmd_buf[i][j].offset) < + frame_process->cmd_buf[i][j].length)) { + CAM_ERR(CAM_OPE, "Invalid offset."); + return -EINVAL; + } cpu_addr = cpu_addr + frame_process->cmd_buf[i][j].offset; CAM_DBG(CAM_OPE, "Hdl %x size %d len %d off %d", @@ -2240,6 +2248,10 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr, uint32_t s_idx = 0; s_idx = cmd_buf->stripe_idx; + if (s_idx < 0 || s_idx >= OPE_MAX_STRIPES) { + CAM_ERR(CAM_OPE, "Invalid index."); + return -EINVAL; + } num_cmd_bufs = ope_request->num_stripe_cmd_bufs[i][s_idx]; From b02ebefbe7653718115d5cf16414fd1f4ececce9 Mon Sep 17 00:00:00 2001 From: jinguiw Date: Tue, 2 Jul 2024 15:22:37 +0530 Subject: [PATCH 2/3] msm: camera: icp: io buf config num validation There are only limitations for CAM_BUF_IN and CAM_BUF_OUT in config validation, but there will be CAM_BUF_IN_OUT type also. In process io config, both CAM_BUF_OUT and CAM_BUF_IN_OUT types are in out_map_entries. No limitation for CAM_BUF_IN_OUT will lead to out of bound for out_map_entries. This change adds check for num of io config need in out_map_entries to avoid out of bound risk. CRs-Fixed: 3857308 Change-Id: I69163a4264d226d617cbe4f37ba1deb4e6434e31 Signed-off-by: jinguiw --- drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c index 56ebba91e6bf..3889b58679de 100644 --- a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c +++ b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c @@ -4162,7 +4162,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet) packet->io_configs_offset/4); for (i = 0 ; i < packet->num_io_configs; i++) - if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) + if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) || + (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) num_out_map_entries++; if (num_out_map_entries <= CAM_MAX_OUT_RES) { @@ -4313,10 +4314,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr, if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) { sync_in_obj[j++] = io_cfg_ptr[i].fence; prepare_args->num_in_map_entries++; - } else { + } else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) || + (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) { prepare_args->out_map_entries[k++].sync_id = io_cfg_ptr[i].fence; prepare_args->num_out_map_entries++; + } else { + CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u", + io_cfg_ptr[i].direction, + prepare_args->max_out_map_entries, + prepare_args->num_out_map_entries); + return -EINVAL; } CAM_DBG(CAM_REQ, "ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x", From da0ec239b27e9c7eb58551c9e769381566ec14a4 Mon Sep 17 00:00:00 2001 From: jinguiw Date: Wed, 31 Jul 2024 15:01:07 +0530 Subject: [PATCH 3/3] msm: camera: sensor: handling condition for random read Get i2c setting count twice in different location for i2c setting, may lead to out of bound for reg settings. Record i2c setting count in the first fetch to avoid this risk. CRs-Fixed: 3885312 Change-Id: I2a81410fecdf41910d7d2eb0daf233621fe0b452 Signed-off-by: jinguiw --- .../cam_sensor_utils/cam_sensor_util.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c index fd423ef3da0a..325e52e6a5a2 100644 --- a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c +++ b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c @@ -395,10 +395,11 @@ static int32_t cam_sensor_handle_random_read( struct cam_buf_io_cfg *io_cfg) { struct i2c_settings_list *i2c_list; - int32_t rc = 0, cnt = 0; + int32_t rc = 0, cnt = 0, payload_count = 0; + payload_count = cmd_i2c_random_rd->header.count; i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, - cmd_i2c_random_rd->header.count); + payload_count); if ((i2c_list == NULL) || (i2c_list->i2c_settings.reg_setting == NULL)) { CAM_ERR(CAM_SENSOR, @@ -413,7 +414,7 @@ static int32_t cam_sensor_handle_random_read( } else { *cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) + (sizeof(struct cam_cmd_read) * - (cmd_i2c_random_rd->header.count)); + payload_count); i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM; i2c_list->i2c_settings.addr_type = cmd_i2c_random_rd->header.addr_type; @@ -422,8 +423,7 @@ static int32_t cam_sensor_handle_random_read( i2c_list->i2c_settings.size = cmd_i2c_random_rd->header.count; - for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count); - cnt++) { + for (cnt = 0; cnt < payload_count; cnt++) { i2c_list->i2c_settings.reg_setting[cnt].reg_addr = cmd_i2c_random_rd->data_read[cnt].reg_data; }