mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-24 06:59:27 -05:00
136 lines
4.8 KiB
Diff
136 lines
4.8 KiB
Diff
From 2e57a46ab2ba7299d99d9cdc1382bd1e612963fb Mon Sep 17 00:00:00 2001
|
|
From: Hariram Purushothaman <hpurus@codeaurora.org>
|
|
Date: Wed, 24 Jul 2013 10:42:21 -0700
|
|
Subject: msm: camera: Fix various small issues in Actuator driver
|
|
|
|
Bound check and validate userspace parameters direction,
|
|
number of steps and direction sign. Also fix possible
|
|
memory leak in certain error cases.
|
|
|
|
CRs-Fixed: 511349
|
|
Change-Id: Icaa324468574494fb40f2de78e522090806744cb
|
|
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>
|
|
---
|
|
.../msm/camera_v2/sensor/actuator/msm_actuator.c | 40 +++++++++++++++++++---
|
|
include/media/msm_cam_sensor.h | 4 +++
|
|
2 files changed, 40 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
|
|
index 87178b7..fe2c16f 100644
|
|
--- a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
|
|
+++ b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
|
|
@@ -245,6 +245,20 @@ static int32_t msm_actuator_move_focus(
|
|
if (dest_step_pos == a_ctrl->curr_step_pos)
|
|
return rc;
|
|
|
|
+ if ((sign_dir > MSM_ACTUATOR_MOVE_SIGNED_NEAR) ||
|
|
+ (sign_dir < MSM_ACTUATOR_MOVE_SIGNED_FAR)) {
|
|
+ pr_err("Invalid sign_dir = %d\n", sign_dir);
|
|
+ return -EFAULT;
|
|
+ }
|
|
+ if ((dir > MOVE_FAR) || (dir < MOVE_NEAR)) {
|
|
+ pr_err("Invalid direction = %d\n", dir);
|
|
+ return -EFAULT;
|
|
+ }
|
|
+ if (dest_step_pos > a_ctrl->total_steps) {
|
|
+ pr_err("Step pos greater than total steps = %d\n",
|
|
+ dest_step_pos);
|
|
+ return -EFAULT;
|
|
+ }
|
|
curr_lens_pos = a_ctrl->step_position_table[a_ctrl->curr_step_pos];
|
|
a_ctrl->i2c_tbl_index = 0;
|
|
CDBG("curr_step_pos =%d dest_step_pos =%d curr_lens_pos=%d\n",
|
|
@@ -318,6 +332,12 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl,
|
|
kfree(a_ctrl->step_position_table);
|
|
a_ctrl->step_position_table = NULL;
|
|
|
|
+ if (set_info->af_tuning_params.total_steps
|
|
+ > MAX_ACTUATOR_AF_TOTAL_STEPS) {
|
|
+ pr_err("Max actuator totalsteps exceeded = %d\n",
|
|
+ set_info->af_tuning_params.total_steps);
|
|
+ return -EFAULT;
|
|
+ }
|
|
/* Fill step position table */
|
|
a_ctrl->step_position_table =
|
|
kmalloc(sizeof(uint16_t) *
|
|
@@ -409,12 +429,19 @@ static int32_t msm_actuator_init(struct msm_actuator_ctrl_t *a_ctrl,
|
|
pr_err("Actuator function table not found\n");
|
|
return rc;
|
|
}
|
|
-
|
|
- a_ctrl->region_size = set_info->af_tuning_params.region_size;
|
|
- if (a_ctrl->region_size > MAX_ACTUATOR_REGION) {
|
|
+ if (set_info->af_tuning_params.total_steps
|
|
+ > MAX_ACTUATOR_AF_TOTAL_STEPS) {
|
|
+ pr_err("Max actuator totalsteps exceeded = %d\n",
|
|
+ set_info->af_tuning_params.total_steps);
|
|
+ return -EFAULT;
|
|
+ }
|
|
+ if (set_info->af_tuning_params.region_size
|
|
+ > MAX_ACTUATOR_REGION) {
|
|
pr_err("MAX_ACTUATOR_REGION is exceeded.\n");
|
|
return -EFAULT;
|
|
}
|
|
+
|
|
+ a_ctrl->region_size = set_info->af_tuning_params.region_size;
|
|
a_ctrl->pwd_step = set_info->af_tuning_params.pwd_step;
|
|
a_ctrl->total_steps = set_info->af_tuning_params.total_steps;
|
|
|
|
@@ -461,7 +488,9 @@ static int32_t msm_actuator_init(struct msm_actuator_ctrl_t *a_ctrl,
|
|
return -EFAULT;
|
|
}
|
|
|
|
- if (set_info->actuator_params.init_setting_size) {
|
|
+ if (set_info->actuator_params.init_setting_size &&
|
|
+ set_info->actuator_params.init_setting_size
|
|
+ <= MAX_ACTUATOR_REG_TBL_SIZE) {
|
|
if (a_ctrl->func_tbl->actuator_init_focus) {
|
|
init_settings = kmalloc(sizeof(struct reg_settings_t) *
|
|
(set_info->actuator_params.init_setting_size),
|
|
@@ -793,6 +822,7 @@ static int32_t msm_actuator_platform_probe(struct platform_device *pdev)
|
|
&pdev->id);
|
|
CDBG("cell-index %d, rc %d\n", pdev->id, rc);
|
|
if (rc < 0) {
|
|
+ kfree(msm_actuator_t);
|
|
pr_err("failed rc %d\n", rc);
|
|
return rc;
|
|
}
|
|
@@ -801,6 +831,7 @@ static int32_t msm_actuator_platform_probe(struct platform_device *pdev)
|
|
&msm_actuator_t->cci_master);
|
|
CDBG("qcom,cci-master %d, rc %d\n", msm_actuator_t->cci_master, rc);
|
|
if (rc < 0) {
|
|
+ kfree(msm_actuator_t);
|
|
pr_err("failed rc %d\n", rc);
|
|
return rc;
|
|
}
|
|
@@ -817,6 +848,7 @@ static int32_t msm_actuator_platform_probe(struct platform_device *pdev)
|
|
msm_actuator_t->i2c_client.cci_client = kzalloc(sizeof(
|
|
struct msm_camera_cci_client), GFP_KERNEL);
|
|
if (!msm_actuator_t->i2c_client.cci_client) {
|
|
+ kfree(msm_actuator_t);
|
|
pr_err("failed no memory\n");
|
|
return -ENOMEM;
|
|
}
|
|
diff --git a/include/media/msm_cam_sensor.h b/include/media/msm_cam_sensor.h
|
|
index 326e8bf..08a2025 100644
|
|
--- a/include/media/msm_cam_sensor.h
|
|
+++ b/include/media/msm_cam_sensor.h
|
|
@@ -40,10 +40,14 @@
|
|
#define MAX_ACTUATOR_REGION 5
|
|
#define MAX_ACTUATOR_INIT_SET 12
|
|
#define MAX_ACTUATOR_REG_TBL_SIZE 8
|
|
+#define MAX_ACTUATOR_AF_TOTAL_STEPS 1024
|
|
|
|
#define MOVE_NEAR 0
|
|
#define MOVE_FAR 1
|
|
|
|
+#define MSM_ACTUATOR_MOVE_SIGNED_FAR -1
|
|
+#define MSM_ACTUATOR_MOVE_SIGNED_NEAR 1
|
|
+
|
|
#define MAX_EEPROM_NAME 32
|
|
|
|
#define MAX_AF_ITERATIONS 3
|
|
--
|
|
cgit v1.1
|
|
|