A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 03:45:24 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: camera: icp: io buf config num validation

Browse source 
There are only limitations for CAM_BUF_IN and CAM_BUF_OUT in
config validation, but there will be CAM_BUF_IN_OUT type also.
In process io config, both CAM_BUF_OUT and CAM_BUF_IN_OUT types
are in out_map_entries. No limitation for CAM_BUF_IN_OUT will
lead to out of bound for out_map_entries. This change adds check
for num of io config need in out_map_entries to avoid
out of bound risk.

CRs-Fixed: 3857308
Change-Id: I69163a4264d226d617cbe4f37ba1deb4e6434e31
Signed-off-by: jinguiw <quic_jinguiw@quicinc.com>
This commit is contained in:
jinguiw 2024-07-02 15:22:37 +05:30 • committed by Prateek Pallav
commit c74ff3c92d
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
View file

@ -4162,7 +4162,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet)
packet->io_configs_offset/4);
for (i = 0 ; i < packet->num_io_configs; i++)
if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)
if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT))
num_out_map_entries++;
if (num_out_map_entries <= CAM_MAX_OUT_RES) {
@ -4313,10 +4314,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr,
if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {
sync_in_obj[j++] = io_cfg_ptr[i].fence;
prepare_args->num_in_map_entries++;
} else {
} else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||
(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) {
prepare_args->out_map_entries[k++].sync_id =
io_cfg_ptr[i].fence;
prepare_args->num_out_map_entries++;
} else {
CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u",
io_cfg_ptr[i].direction,
prepare_args->max_out_map_entries,
prepare_args->num_out_map_entries);
return -EINVAL;
}
CAM_DBG(CAM_REQ,
"ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",