A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

camera: ois: add dw9781c packet judgement

Browse source 
Sometimes dw9781c packet can reach to 20 for unknown reason.
Add packet judgement to avoid buffer overflow.

Change-Id: I6920fe1310cbf340e2e3b8c624d2c1b3400c75a0
Signed-off-by: liuwang2 <[email protected]>
Reviewed-on: https://gerrit.mot.com/2163312
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: XiaoFeng Wang <[email protected]>
Reviewed-by: Long Cheng <[email protected]>
Reviewed-by: Shuo Wang <[email protected]>
Reviewed-by: Zhichao Chen <[email protected]>
Submit-Approved: Jira Key
This commit is contained in:
liuwang2 2022-01-06 14:55:49 +08:00 • committed by zhaoji1
commit 86a6f14b08
3 changed files with 12 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/cam_sensor_module/cam_ois/cam_ois_core.c
View file

@ -1218,7 +1218,7 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
CAM_DBG(CAM_OIS, "buff_length = %d, read_length = %d", buff_length, read_length);
if (read_length > buff_length) {
if (read_length > buff_length || buff_length < PACKET_BYTE*MAX_PACKET) {
CAM_ERR(CAM_SENSOR,
"Invalid buffer size, readLen: %d, bufLen: %d",
read_length, buff_length);

15
drivers/cam_sensor_module/cam_ois/cam_ois_dev.c
View file

@ -296,9 +296,9 @@ static int cam_ois_i2c_driver_remove(struct i2c_client *client)
static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
{
struct cam_ois_ctrl_t *o_ctrl = data;
int rc = 0, handled = IRQ_NONE, packet_cnt;
int rc = 0, handled = IRQ_NONE, packet_cnt = 0, sample_cnt = 0;
uint64_t qtime_ns;
uint8_t *read_buff, sample_cnt;
uint8_t *read_buff;
uint32_t k, read_len;
if (!mutex_trylock(&o_ctrl->vsync_mutex)) {
@ -332,11 +332,9 @@ static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
memset(o_ctrl->ois_data, 0, o_ctrl->ois_data_size);
read_buff = o_ctrl->ois_data;
packet_cnt = 0;
sample_cnt = 0;
do {
if (packet_cnt > 0)
if (packet_cnt > 0 && packet_cnt < MAX_PACKET)
read_buff += PACKET_BYTE;
// SM6375: CCI_VERSION_1_2_9 can only support read 0xE bytes data one time.
@ -364,6 +362,13 @@ static irqreturn_t cam_ois_vsync_irq_thread(int irq, void *data)
if (sample_cnt != 0) {
packet_cnt = (sample_cnt + 9)/10;
CAM_DBG(CAM_OIS,"sample data = 0x%x, packet_cnt = %d", sample_cnt, packet_cnt);
// we only need max 30 sample.
if (packet_cnt > MAX_PACKET || sample_cnt > MAX_SAMPLE) {
CAM_WARN(CAM_OIS,"Too many packet, skip this read");
rc = -EINVAL;
goto release_mutex;
}
} else {
CAM_WARN(CAM_OIS,"No-fatal: sample data is zero, break the loop read");
goto release_mutex;

1
drivers/cam_sensor_module/cam_ois/cam_ois_dev.h
View file

@ -28,6 +28,7 @@
#define PACKET_ADDR 0x70B0
#define PACKET_BYTE 62
#define MAX_PACKET 5
#define MAX_SAMPLE 30
#define READ_BYTE 0xC
enum cam_ois_state {