duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "msm: camera: isp: validate in_port before accessing" into camera-kernel.lnx.3.1

Browse Source
This commit is contained in:
Camera Software Integration authored and Gerrit - the friendly Code Review server committed 2020-05-12 01:53:43 -07:00
2 parents f7e9138b9a a873fb67b3
commit 7dec63cea8
1 file changed
+44 -6
Download Patch File Download Diff File Expand all files Collapse all files
drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+44 -6
View File
@@ -2119,18 +2119,36 @@ err:
static int cam_ife_mgr_check_and_update_fe_v0(
struct cam_ife_hw_mgr_ctx *ife_ctx,
struct cam_isp_acquire_hw_info *acquire_hw_info)
struct cam_isp_acquire_hw_info *acquire_hw_info,
uint32_t acquire_info_size)
{
int i;
struct cam_isp_in_port_info *in_port = NULL;
uint32_t in_port_length = 0;
uint32_t total_in_port_length = 0;
if (acquire_hw_info->input_info_offset >=
acquire_hw_info->input_info_size) {
CAM_ERR(CAM_ISP,
"Invalid size offset 0x%x is greater then size 0x%x",
acquire_hw_info->input_info_offset,
acquire_hw_info->input_info_size);
return -EINVAL;
}
in_port = (struct cam_isp_in_port_info *)
((uint8_t *)&acquire_hw_info->data +
acquire_hw_info->input_info_offset);
for (i = 0; i < acquire_hw_info->num_inputs; i++) {
if (((uint8_t *)in_port +
sizeof(struct cam_isp_in_port_info)) >
((uint8_t *)acquire_hw_info +
acquire_info_size)) {
CAM_ERR(CAM_ISP, "Invalid size");
return -EINVAL;
}
if ((in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) ||
(in_port->num_out_res <= 0)) {
CAM_ERR(CAM_ISP, "Invalid num output res %u",
@@ -2164,18 +2182,36 @@ static int cam_ife_mgr_check_and_update_fe_v0(
static int cam_ife_mgr_check_and_update_fe_v2(
struct cam_ife_hw_mgr_ctx *ife_ctx,
struct cam_isp_acquire_hw_info *acquire_hw_info)
struct cam_isp_acquire_hw_info *acquire_hw_info,
uint32_t acquire_info_size)
{
int i;
struct cam_isp_in_port_info_v2 *in_port = NULL;
uint32_t in_port_length = 0;
uint32_t total_in_port_length = 0;
if (acquire_hw_info->input_info_offset >=
acquire_hw_info->input_info_size) {
CAM_ERR(CAM_ISP,
"Invalid size offset 0x%x is greater then size 0x%x",
acquire_hw_info->input_info_offset,
acquire_hw_info->input_info_size);
return -EINVAL;
}
in_port = (struct cam_isp_in_port_info_v2 *)
((uint8_t *)&acquire_hw_info->data +
acquire_hw_info->input_info_offset);
for (i = 0; i < acquire_hw_info->num_inputs; i++) {
if (((uint8_t *)in_port +
sizeof(struct cam_isp_in_port_info)) >
((uint8_t *)acquire_hw_info +
acquire_info_size)) {
CAM_ERR(CAM_ISP, "Invalid size");
return -EINVAL;
}
if ((in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) ||
(in_port->num_out_res <= 0)) {
CAM_ERR(CAM_ISP, "Invalid num output res %u",
@@ -2209,7 +2245,8 @@ static int cam_ife_mgr_check_and_update_fe_v2(
static int cam_ife_mgr_check_and_update_fe(
struct cam_ife_hw_mgr_ctx *ife_ctx,
struct cam_isp_acquire_hw_info *acquire_hw_info)
struct cam_isp_acquire_hw_info *acquire_hw_info,
uint32_t acquire_info_size)
{
uint32_t major_ver = 0, minor_ver = 0;
@@ -2222,10 +2259,10 @@ static int cam_ife_mgr_check_and_update_fe(
switch (major_ver) {
case 1:
return cam_ife_mgr_check_and_update_fe_v0(
ife_ctx, acquire_hw_info);
ife_ctx, acquire_hw_info, acquire_info_size);
case 2:
return cam_ife_mgr_check_and_update_fe_v2(
ife_ctx, acquire_hw_info);
ife_ctx, acquire_hw_info, acquire_info_size);
break;
default:
CAM_ERR(CAM_ISP, "Invalid ver of common info from user");
@@ -2728,7 +2765,8 @@ static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
acquire_hw_info =
(struct cam_isp_acquire_hw_info *)acquire_args->acquire_info;
rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info);
rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info,
acquire_args->acquire_info_size);
if (rc) {
CAM_ERR(CAM_ISP, "buffer size is not enough");
goto free_cdm;