A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

camera: ois: modify active ois code

Browse source 
modify max packet to 5.
avoid buffer overflow issue.

Change-Id: Idf60aeebe349dca8b7c0da3132abae74c3e892dc
Signed-off-by: liuwang2 <liuwang2@lenovo.com>
Reviewed-on: https://gerrit.mot.com/2159174
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: <liuzy55@motorola.com>
Reviewed-by: Long Cheng <chengl1@motorola.com>
Reviewed-by: Zhichao Chen <chenzc2@motorola.com>
Submit-Approved: Jira Key
This commit is contained in:
liuwang2 2021-12-31 10:42:00 +08:00 • committed by zhaoji1
commit 5aa8af341f
3 changed files with 27 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

14
drivers/cam_sensor_module/cam_ois/cam_ois_core.c
View file

@ -1216,6 +1216,8 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
buff_length = i2c_list->i2c_settings.read_buff_len;
read_length = i2c_list->i2c_settings.size;
CAM_DBG(CAM_OIS, "buff_length = %d, read_length = %d", buff_length, read_length);
if (read_length > buff_length) {
CAM_ERR(CAM_SENSOR,
"Invalid buffer size, readLen: %d, bufLen: %d",
@ -1244,13 +1246,13 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
}
mutex_lock(&(o_ctrl->vsync_mutex));
memcpy((void *)timestampBuf,
(void *)&o_ctrl->prev_timestamp,
sizeof(uint64_t));
memcpy((void *)timestampBuf, (void *)&o_ctrl->prev_timestamp, sizeof(uint64_t));
if (o_ctrl->ois_data_size <= buff_length)
memcpy((void *)read_buff, (void *)o_ctrl->ois_data, o_ctrl->ois_data_size);
else
memcpy((void *)read_buff, (void *)o_ctrl->ois_data, buff_length);
memcpy((void *)read_buff,
(void *)o_ctrl->ois_data,
sizeof(o_ctrl->ois_data));
mutex_unlock(&(o_ctrl->vsync_mutex));
} else if (i2c_list->op_code == CAM_SENSOR_I2C_POLL) {
size = i2c_list->i2c_settings.size;

22
drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
View file

@ -296,9 +296,9 @@ static int cam_ois_i2c_driver_remove(struct i2c_client *client)
static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
{
struct cam_ois_ctrl_t *o_ctrl = data;
int rc = 0, handled = IRQ_NONE;
int rc = 0, handled = IRQ_NONE, packet_cnt;
uint64_t qtime_ns;
uint8_t *read_buff, packet_cnt, sample_cnt;
uint8_t *read_buff, sample_cnt;
uint32_t k, read_len;
if (!mutex_trylock(&o_ctrl->vsync_mutex)) {
@ -330,12 +330,15 @@ static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
goto release_mutex;
}
memset(o_ctrl->ois_data, 0, sizeof(o_ctrl->ois_data));
memset(o_ctrl->ois_data, 0, o_ctrl->ois_data_size);
read_buff = o_ctrl->ois_data;
packet_cnt = 0;
sample_cnt = 0;
do {
if (packet_cnt > 0)
read_buff += PACKET_BYTE;
// SM6375: CCI_VERSION_1_2_9 can only support read 0xE bytes data one time.
for (k = 0; k < PACKET_BYTE/READ_BYTE + 1; k++) {
if (k == PACKET_BYTE/READ_BYTE)
@ -380,12 +383,11 @@ static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
}
packet_cnt--;
read_buff += PACKET_BYTE;
} while(packet_cnt);
release_mutex:
if (rc < 0) {
memset(o_ctrl->ois_data, 0, sizeof(o_ctrl->ois_data));
memset(o_ctrl->ois_data, 0, o_ctrl->ois_data_size);
handled = IRQ_NONE;
} else
handled = IRQ_HANDLED;
@ -415,12 +417,17 @@ static int cam_ois_component_bind(struct device *dev,
o_ctrl->soc_info.dev_name = pdev->name;
o_ctrl->ois_device_type = MSM_CAMERA_PLATFORM_DEVICE;
o_ctrl->ois_data_size = PACKET_BYTE*MAX_PACKET;
o_ctrl->ois_data = kzalloc(o_ctrl->ois_data_size, GFP_KERNEL);
if (!o_ctrl->ois_data)
goto free_o_ctrl;
o_ctrl->io_master_info.master_type = CCI_MASTER;
o_ctrl->io_master_info.cci_client = kzalloc(
sizeof(struct cam_sensor_cci_client), GFP_KERNEL);
if (!o_ctrl->io_master_info.cci_client)
goto free_o_ctrl;
goto free_ois_data;
soc_private = kzalloc(sizeof(struct cam_ois_soc_private),
GFP_KERNEL);
@ -490,6 +497,8 @@ free_soc:
kfree(soc_private);
free_cci_client:
kfree(o_ctrl->io_master_info.cci_client);
free_ois_data:
kfree(o_ctrl->ois_data);
free_o_ctrl:
kfree(o_ctrl);
return rc;
@ -527,6 +536,7 @@ static void cam_ois_component_unbind(struct device *dev,
kfree(o_ctrl->soc_info.soc_private);
kfree(o_ctrl->io_master_info.cci_client);
kfree(o_ctrl->ois_data);
platform_set_drvdata(pdev, NULL);
v4l2_set_subdevdata(&o_ctrl->v4l2_dev_str.sd, NULL);
kfree(o_ctrl);

5
drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
View file

@ -27,7 +27,7 @@
#define PACKET_ADDR 0x70B0
#define PACKET_BYTE 62
#define MAX_PACKET 3
#define MAX_PACKET 5
#define READ_BYTE 0xC
enum cam_ois_state {
@ -155,7 +155,8 @@ struct cam_ois_ctrl_t {
struct mutex vsync_mutex;
struct completion ois_data_complete;
bool is_first_vsync;
uint8_t ois_data[PACKET_BYTE*MAX_PACKET];
uint8_t *ois_data;
int ois_data_size;
};
/**