From 27597eb95bf4c5f089d24afb990f007f666dba0b Mon Sep 17 00:00:00 2001 From: Shivi Mangal Date: Thu, 21 Mar 2024 17:36:40 -0700 Subject: [PATCH] msm: camera: sensor: Handling race condition in util api I2C cmd is coming from user space which can be modified due to access to shared memory. This change scopes the data locally so as to avoid vulnerability of count being modified by external means while executing due to being in shared memory. CRs-Fixed: 3707472 Change-Id: I8a89e23e99b80b089ed4c4cf3098feead752356e Signed-off-by: Shivi Mangal (cherry picked from commit 4e00cc5f9f81bf471d58ee5d6beb210a5326fcff) (cherry picked from commit 6245be68a914dd9984c259ab3c6bc1647c1593be) --- .../cam_sensor_utils/cam_sensor_util.c | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c index b4da51bfee99..fd423ef3da0a 100644 --- a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c +++ b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c @@ -195,10 +195,11 @@ int32_t cam_sensor_handle_random_write( struct list_head **list) { struct i2c_settings_list *i2c_list; - int32_t rc = 0, cnt; + int32_t rc = 0, cnt, payload_count; + payload_count = cam_cmd_i2c_random_wr->header.count; i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, - cam_cmd_i2c_random_wr->header.count); + payload_count); if (i2c_list == NULL || i2c_list->i2c_settings.reg_setting == NULL) { CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list"); @@ -207,15 +208,14 @@ int32_t cam_sensor_handle_random_write( *cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) + sizeof(struct i2c_random_wr_payload) * - (cam_cmd_i2c_random_wr->header.count)); + payload_count); i2c_list->op_code = CAM_SENSOR_I2C_WRITE_RANDOM; i2c_list->i2c_settings.addr_type = cam_cmd_i2c_random_wr->header.addr_type; i2c_list->i2c_settings.data_type = cam_cmd_i2c_random_wr->header.data_type; - for (cnt = 0; cnt < (cam_cmd_i2c_random_wr->header.count); - cnt++) { + for (cnt = 0; cnt < payload_count; cnt++) { i2c_list->i2c_settings.reg_setting[cnt].reg_addr = cam_cmd_i2c_random_wr->random_wr_payload[cnt].reg_addr; i2c_list->i2c_settings.reg_setting[cnt].reg_data = @@ -235,10 +235,11 @@ static int32_t cam_sensor_handle_continuous_write( struct list_head **list) { struct i2c_settings_list *i2c_list; - int32_t rc = 0, cnt; + int32_t rc = 0, cnt, payload_count; + payload_count = cam_cmd_i2c_continuous_wr->header.count; i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, - cam_cmd_i2c_continuous_wr->header.count); + payload_count); if (i2c_list == NULL || i2c_list->i2c_settings.reg_setting == NULL) { CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list"); @@ -248,7 +249,7 @@ static int32_t cam_sensor_handle_continuous_write( *cmd_length_in_bytes = (sizeof(struct i2c_rdwr_header) + sizeof(cam_cmd_i2c_continuous_wr->reg_addr) + sizeof(struct cam_cmd_read) * - (cam_cmd_i2c_continuous_wr->header.count)); + (payload_count)); if (cam_cmd_i2c_continuous_wr->header.op_code == CAMERA_SENSOR_I2C_OP_CONT_WR_BRST) i2c_list->op_code = CAM_SENSOR_I2C_WRITE_BURST; @@ -265,8 +266,7 @@ static int32_t cam_sensor_handle_continuous_write( i2c_list->i2c_settings.size = cam_cmd_i2c_continuous_wr->header.count; - for (cnt = 0; cnt < (cam_cmd_i2c_continuous_wr->header.count); - cnt++) { + for (cnt = 0; cnt < payload_count; cnt++) { i2c_list->i2c_settings.reg_setting[cnt].reg_addr = cam_cmd_i2c_continuous_wr->reg_addr; i2c_list->i2c_settings.reg_setting[cnt].reg_data =