From 08d0784e99c42d301d4aac169cf6e7140529ed3d Mon Sep 17 00:00:00 2001 From: jinguiw Date: Thu, 11 Jul 2024 18:03:15 +0530 Subject: [PATCH 1/3] msm: camera: ope: check cpu buffer offset and cmd buf idx No check for cpu buffer offset, which may lead to out of cpu buffer map. No check for cmd buffer index, which may lead to out of bound or negative index. Adding check for cpu buffer map offset and adding check for cmd buffer index. CRs-Fixed: 3864084 Change-Id: I39494b0a9f323cb5569d37a0c033b2eaf8fbd32c Signed-off-by: jinguiw --- drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c index 64ed8f360348..31cad8f760a8 100644 --- a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c +++ b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c @@ -2192,6 +2192,14 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr, hw_mgr->iommu_hdl); goto end; } + if ((len <= frame_process->cmd_buf[i][j].offset) || + (frame_process->cmd_buf[i][j].size < + frame_process->cmd_buf[i][j].length) || + ((len - frame_process->cmd_buf[i][j].offset) < + frame_process->cmd_buf[i][j].length)) { + CAM_ERR(CAM_OPE, "Invalid offset."); + return -EINVAL; + } cpu_addr = cpu_addr + frame_process->cmd_buf[i][j].offset; CAM_DBG(CAM_OPE, "Hdl %x size %d len %d off %d", @@ -2240,6 +2248,10 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr, uint32_t s_idx = 0; s_idx = cmd_buf->stripe_idx; + if (s_idx < 0 || s_idx >= OPE_MAX_STRIPES) { + CAM_ERR(CAM_OPE, "Invalid index."); + return -EINVAL; + } num_cmd_bufs = ope_request->num_stripe_cmd_bufs[i][s_idx]; From c74ff3c92db62a2f48db0ca1e7bf26ffdf364112 Mon Sep 17 00:00:00 2001 From: jinguiw Date: Tue, 2 Jul 2024 15:22:37 +0530 Subject: [PATCH 2/3] msm: camera: icp: io buf config num validation There are only limitations for CAM_BUF_IN and CAM_BUF_OUT in config validation, but there will be CAM_BUF_IN_OUT type also. In process io config, both CAM_BUF_OUT and CAM_BUF_IN_OUT types are in out_map_entries. No limitation for CAM_BUF_IN_OUT will lead to out of bound for out_map_entries. This change adds check for num of io config need in out_map_entries to avoid out of bound risk. CRs-Fixed: 3857308 Change-Id: I69163a4264d226d617cbe4f37ba1deb4e6434e31 Signed-off-by: jinguiw --- drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c index 56ebba91e6bf..3889b58679de 100644 --- a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c +++ b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c @@ -4162,7 +4162,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet) packet->io_configs_offset/4); for (i = 0 ; i < packet->num_io_configs; i++) - if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) + if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) || + (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) num_out_map_entries++; if (num_out_map_entries <= CAM_MAX_OUT_RES) { @@ -4313,10 +4314,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr, if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) { sync_in_obj[j++] = io_cfg_ptr[i].fence; prepare_args->num_in_map_entries++; - } else { + } else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) || + (io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) { prepare_args->out_map_entries[k++].sync_id = io_cfg_ptr[i].fence; prepare_args->num_out_map_entries++; + } else { + CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u", + io_cfg_ptr[i].direction, + prepare_args->max_out_map_entries, + prepare_args->num_out_map_entries); + return -EINVAL; } CAM_DBG(CAM_REQ, "ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x", From 4bc8ff3984e6accb136871b12b7017d0aa943812 Mon Sep 17 00:00:00 2001 From: jinguiw Date: Wed, 31 Jul 2024 15:01:07 +0530 Subject: [PATCH 3/3] msm: camera: sensor: handling condition for random read Get i2c setting count twice in different location for i2c setting, may lead to out of bound for reg settings. Record i2c setting count in the first fetch to avoid this risk. CRs-Fixed: 3885312 Change-Id: I2a81410fecdf41910d7d2eb0daf233621fe0b452 Signed-off-by: jinguiw --- .../cam_sensor_utils/cam_sensor_util.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c index fd423ef3da0a..325e52e6a5a2 100644 --- a/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c +++ b/drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c @@ -395,10 +395,11 @@ static int32_t cam_sensor_handle_random_read( struct cam_buf_io_cfg *io_cfg) { struct i2c_settings_list *i2c_list; - int32_t rc = 0, cnt = 0; + int32_t rc = 0, cnt = 0, payload_count = 0; + payload_count = cmd_i2c_random_rd->header.count; i2c_list = cam_sensor_get_i2c_ptr(i2c_reg_settings, - cmd_i2c_random_rd->header.count); + payload_count); if ((i2c_list == NULL) || (i2c_list->i2c_settings.reg_setting == NULL)) { CAM_ERR(CAM_SENSOR, @@ -413,7 +414,7 @@ static int32_t cam_sensor_handle_random_read( } else { *cmd_length_in_bytes = sizeof(struct i2c_rdwr_header) + (sizeof(struct cam_cmd_read) * - (cmd_i2c_random_rd->header.count)); + payload_count); i2c_list->op_code = CAM_SENSOR_I2C_READ_RANDOM; i2c_list->i2c_settings.addr_type = cmd_i2c_random_rd->header.addr_type; @@ -422,8 +423,7 @@ static int32_t cam_sensor_handle_random_read( i2c_list->i2c_settings.size = cmd_i2c_random_rd->header.count; - for (cnt = 0; cnt < (cmd_i2c_random_rd->header.count); - cnt++) { + for (cnt = 0; cnt < payload_count; cnt++) { i2c_list->i2c_settings.reg_setting[cnt].reg_addr = cmd_i2c_random_rd->data_read[cnt].reg_data; }