mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
67 lines
2.2 KiB
Diff
67 lines
2.2 KiB
Diff
|
From 68c459daa22a26d6ca8f169baef6605ca8a285f2 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Alok Kediya <kediya@codeaurora.org>
|
||
|
|
Date: Tue, 9 Dec 2014 12:53:29 +0530
|
||
|
|
Subject: msm: camera: isp: Validate reg_offset and len parameters
|
||
|
|
|
||
|
|
Validate reg_offset and len parameters before consuming to
|
||
|
|
avoid invalid register access.
|
||
|
|
|
||
|
|
Change-Id: I07676a6d10a9945fb0b99ebfd147075f896fbfab
|
||
|
|
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
|
||
|
|
---
|
||
|
|
.../platform/msm/camera_v2/isp/msm_isp_util.c | 36 +++++++++++++++++++---
|
||
|
|
1 file changed, 31 insertions(+), 5 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
|
||
|
|
index 12fd081..620c01a 100644
|
||
|
|
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
|
||
|
|
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
|
||
|
|
@@ -495,13 +495,39 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev,
|
||
|
|
uint32_t *cfg_data, uint32_t cmd_len)
|
||
|
|
{
|
||
|
|
switch (reg_cfg_cmd->cmd_type) {
|
||
|
|
- case VFE_WRITE: {
|
||
|
|
- if (resource_size(vfe_dev->vfe_mem) <
|
||
|
|
- (reg_cfg_cmd->u.rw_info.reg_offset +
|
||
|
|
- reg_cfg_cmd->u.rw_info.len)) {
|
||
|
|
- pr_err("%s: VFE_WRITE: Invalid length\n", __func__);
|
||
|
|
+ case VFE_WRITE:
|
||
|
|
+ case VFE_READ: {
|
||
|
|
+ if ((reg_cfg_cmd->u.rw_info.reg_offset >
|
||
|
|
+ (UINT_MAX - reg_cfg_cmd->u.rw_info.len)) ||
|
||
|
|
+ ((reg_cfg_cmd->u.rw_info.reg_offset +
|
||
|
|
+ reg_cfg_cmd->u.rw_info.len) >
|
||
|
|
+ resource_size(vfe_dev->vfe_mem))) {
|
||
|
|
+ pr_err("%s:%d reg_offset %d len %d res %d\n",
|
||
|
|
+ __func__, __LINE__,
|
||
|
|
+ reg_cfg_cmd->u.rw_info.reg_offset,
|
||
|
|
+ reg_cfg_cmd->u.rw_info.len,
|
||
|
|
+ (uint32_t)resource_size(vfe_dev->vfe_mem));
|
||
|
|
return -EINVAL;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+ if ((reg_cfg_cmd->u.rw_info.cmd_data_offset >
|
||
|
|
+ (UINT_MAX - reg_cfg_cmd->u.rw_info.len)) ||
|
||
|
|
+ ((reg_cfg_cmd->u.rw_info.cmd_data_offset +
|
||
|
|
+ reg_cfg_cmd->u.rw_info.len) > cmd_len)) {
|
||
|
|
+ pr_err("%s:%d cmd_data_offset %d len %d cmd_len %d\n",
|
||
|
|
+ __func__, __LINE__,
|
||
|
|
+ reg_cfg_cmd->u.rw_info.cmd_data_offset,
|
||
|
|
+ reg_cfg_cmd->u.rw_info.len, cmd_len);
|
||
|
|
+ return -EINVAL;
|
||
|
|
+ }
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
+ default:
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
+ switch (reg_cfg_cmd->cmd_type) {
|
||
|
|
+ case VFE_WRITE: {
|
||
|
|
msm_camera_io_memcpy(vfe_dev->vfe_base +
|
||
|
|
reg_cfg_cmd->u.rw_info.reg_offset,
|
||
|
|
cfg_data + reg_cfg_cmd->u.rw_info.cmd_data_offset/4,
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|