From c74ff3c92db62a2f48db0ca1e7bf26ffdf364112 Mon Sep 17 00:00:00 2001 From: jinguiw Date: Tue, 2 Jul 2024 15:22:37 +0530 Subject: [PATCH] msm: camera: icp: io buf config num validation There are only limitations for CAM_BUF_IN and CAM_BUF_OUT in config validation, but there will be CAM_BUF_IN_OUT type also. In process io config, both CAM_BUF_OUT and CAM_BUF_IN_OUT types are in out_map_entries. No limitation for CAM_BUF_IN_OUT will lead to out of bound for out_map_entries. This change adds check for num of io config need in out_map_entries to avoid out of bound risk. CRs-Fixed: 3857308 Change-Id: I69163a4264d226d617cbe4f37ba1deb4e6434e31 Signed-off-by: jinguiw --- drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c index 56ebba91e6bf..3889b58679de 100644 --- a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c +++ b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c @@ -4162,7 +4162,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet) packet->io_configs_offset/4); for (i = 0 ; i < packet->num_io_configs; i++) - if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) + if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) || + (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) num_out_map_entries++; if (num_out_map_entries <= CAM_MAX_OUT_RES) { @@ -4313,10 +4314,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr, if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) { sync_in_obj[j++] = io_cfg_ptr[i].fence; prepare_args->num_in_map_entries++; - } else { + } else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) || + (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) { prepare_args->out_map_entries[k++].sync_id = io_cfg_ptr[i].fence; prepare_args->num_out_map_entries++; + } else { + CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u", + io_cfg_ptr[i].direction, + prepare_args->max_out_map_entries, + prepare_args->num_out_map_entries); + return -EINVAL; } CAM_DBG(CAM_REQ, "ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",