From 2e57a46ab2ba7299d99d9cdc1382bd1e612963fb Mon Sep 17 00:00:00 2001 From: Hariram Purushothaman Date: Wed, 24 Jul 2013 10:42:21 -0700 Subject: msm: camera: Fix various small issues in Actuator driver Bound check and validate userspace parameters direction, number of steps and direction sign. Also fix possible memory leak in certain error cases. CRs-Fixed: 511349 Change-Id: Icaa324468574494fb40f2de78e522090806744cb Signed-off-by: Hariram Purushothaman --- .../msm/camera_v2/sensor/actuator/msm_actuator.c | 40 +++++++++++++++++++--- include/media/msm_cam_sensor.h | 4 +++ 2 files changed, 40 insertions(+), 4 deletions(-) diff --git a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c index 87178b7..fe2c16f 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c +++ b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c @@ -245,6 +245,20 @@ static int32_t msm_actuator_move_focus( if (dest_step_pos == a_ctrl->curr_step_pos) return rc; + if ((sign_dir > MSM_ACTUATOR_MOVE_SIGNED_NEAR) || + (sign_dir < MSM_ACTUATOR_MOVE_SIGNED_FAR)) { + pr_err("Invalid sign_dir = %d\n", sign_dir); + return -EFAULT; + } + if ((dir > MOVE_FAR) || (dir < MOVE_NEAR)) { + pr_err("Invalid direction = %d\n", dir); + return -EFAULT; + } + if (dest_step_pos > a_ctrl->total_steps) { + pr_err("Step pos greater than total steps = %d\n", + dest_step_pos); + return -EFAULT; + } curr_lens_pos = a_ctrl->step_position_table[a_ctrl->curr_step_pos]; a_ctrl->i2c_tbl_index = 0; CDBG("curr_step_pos =%d dest_step_pos =%d curr_lens_pos=%d\n", @@ -318,6 +332,12 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl, kfree(a_ctrl->step_position_table); a_ctrl->step_position_table = NULL; + if (set_info->af_tuning_params.total_steps + > MAX_ACTUATOR_AF_TOTAL_STEPS) { + pr_err("Max actuator totalsteps exceeded = %d\n", + set_info->af_tuning_params.total_steps); + return -EFAULT; + } /* Fill step position table */ a_ctrl->step_position_table = kmalloc(sizeof(uint16_t) * @@ -409,12 +429,19 @@ static int32_t msm_actuator_init(struct msm_actuator_ctrl_t *a_ctrl, pr_err("Actuator function table not found\n"); return rc; } - - a_ctrl->region_size = set_info->af_tuning_params.region_size; - if (a_ctrl->region_size > MAX_ACTUATOR_REGION) { + if (set_info->af_tuning_params.total_steps + > MAX_ACTUATOR_AF_TOTAL_STEPS) { + pr_err("Max actuator totalsteps exceeded = %d\n", + set_info->af_tuning_params.total_steps); + return -EFAULT; + } + if (set_info->af_tuning_params.region_size + > MAX_ACTUATOR_REGION) { pr_err("MAX_ACTUATOR_REGION is exceeded.\n"); return -EFAULT; } + + a_ctrl->region_size = set_info->af_tuning_params.region_size; a_ctrl->pwd_step = set_info->af_tuning_params.pwd_step; a_ctrl->total_steps = set_info->af_tuning_params.total_steps; @@ -461,7 +488,9 @@ static int32_t msm_actuator_init(struct msm_actuator_ctrl_t *a_ctrl, return -EFAULT; } - if (set_info->actuator_params.init_setting_size) { + if (set_info->actuator_params.init_setting_size && + set_info->actuator_params.init_setting_size + <= MAX_ACTUATOR_REG_TBL_SIZE) { if (a_ctrl->func_tbl->actuator_init_focus) { init_settings = kmalloc(sizeof(struct reg_settings_t) * (set_info->actuator_params.init_setting_size), @@ -793,6 +822,7 @@ static int32_t msm_actuator_platform_probe(struct platform_device *pdev) &pdev->id); CDBG("cell-index %d, rc %d\n", pdev->id, rc); if (rc < 0) { + kfree(msm_actuator_t); pr_err("failed rc %d\n", rc); return rc; } @@ -801,6 +831,7 @@ static int32_t msm_actuator_platform_probe(struct platform_device *pdev) &msm_actuator_t->cci_master); CDBG("qcom,cci-master %d, rc %d\n", msm_actuator_t->cci_master, rc); if (rc < 0) { + kfree(msm_actuator_t); pr_err("failed rc %d\n", rc); return rc; } @@ -817,6 +848,7 @@ static int32_t msm_actuator_platform_probe(struct platform_device *pdev) msm_actuator_t->i2c_client.cci_client = kzalloc(sizeof( struct msm_camera_cci_client), GFP_KERNEL); if (!msm_actuator_t->i2c_client.cci_client) { + kfree(msm_actuator_t); pr_err("failed no memory\n"); return -ENOMEM; } diff --git a/include/media/msm_cam_sensor.h b/include/media/msm_cam_sensor.h index 326e8bf..08a2025 100644 --- a/include/media/msm_cam_sensor.h +++ b/include/media/msm_cam_sensor.h @@ -40,10 +40,14 @@ #define MAX_ACTUATOR_REGION 5 #define MAX_ACTUATOR_INIT_SET 12 #define MAX_ACTUATOR_REG_TBL_SIZE 8 +#define MAX_ACTUATOR_AF_TOTAL_STEPS 1024 #define MOVE_NEAR 0 #define MOVE_FAR 1 +#define MSM_ACTUATOR_MOVE_SIGNED_FAR -1 +#define MSM_ACTUATOR_MOVE_SIGNED_NEAR 1 + #define MAX_EEPROM_NAME 32 #define MAX_AF_ITERATIONS 3 -- cgit v1.1