A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 14:19:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge changes I52459823,I88d1c764 into camera-kernel-iot.lnx.4.1

Browse source 
* changes:
  msm: camera: isp: Fix potential illegal access in Acquire HW. Fix for above
  msm: camera: isp: Fix potential illegal access in Acquire HW
This commit is contained in:
Linux Build Service Account 2026-03-03 21:50:19 -08:00 • committed by Gerrit - the friendly Code Review server
commit 6aa2110d4f
1 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
drivers/cam_core/cam_node.c
View file

@ -812,6 +812,7 @@ int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd)
}
case CAM_ACQUIRE_HW: {
uint32_t api_version;
uint32_t struct_version;
void *acquire_ptr = NULL;
size_t acquire_size;
@ -846,6 +847,16 @@ int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd)
}
if (api_version == 1) {
struct_version =
((struct cam_acquire_hw_cmd_v1 *)acquire_ptr)->struct_version;
if (struct_version != api_version) {
CAM_ERR(CAM_CORE,
"Unmatched struct api version %u and struct version %u",
api_version, struct_version);
rc = -EINVAL;
goto acquire_kfree;
}
rc = __cam_node_handle_acquire_hw_v1(node, acquire_ptr);
if (rc) {
CAM_ERR(CAM_CORE,
@ -853,6 +864,16 @@ int cam_node_handle_ioctl(struct cam_node *node, struct cam_control *cmd)
goto acquire_kfree;
}
} else if (api_version == 2) {
struct_version =
((struct cam_acquire_hw_cmd_v2 *)acquire_ptr)->struct_version;
if (struct_version != api_version) {
CAM_ERR(CAM_CORE,
"Unmatched struct api version %u and struct version %u",
api_version, struct_version);
rc = -EINVAL;
goto acquire_kfree;
}
rc = __cam_node_handle_acquire_hw_v2(node, acquire_ptr);
if (rc) {
CAM_ERR(CAM_CORE,