android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'LA.UM.9.14.r1-23800-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel into android13-5.4-lahaina

Browse Source 
"LA.UM.9.14.r1-23800-LAHAINA.QSSI14.0"

* tag 'LA.UM.9.14.r1-23800-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
  msm: camera: common: Fix possible OOB reads and writes operation

Change-Id: I943de389f42e93c7ac39c827b176eaea1f65dcb1
This commit is contained in:
Michael Bestas 2024-02-09 00:42:47 +02:00
commit 5a22f4da61
No known key found for this signature in database
GPG Key ID: CC95044519BE6669
11 changed files with 80 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
techpack/camera/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
View File

@ -79,6 +79,10 @@ static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet,
packet->cmd_buf_offset);
for (i = 0; i < packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
/*
* We can allow 0 length cmd buffer. This can happen in case
* umd gives an empty cmd buffer as kmd buffer
@ -805,6 +809,10 @@ static int cam_fd_mgr_util_prepare_hw_update_entries(
&prepare->packet->payload + prepare->packet->cmd_buf_offset);
for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (!cmd_desc[i].length)
continue;

8
techpack/camera/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
View File

@ -4677,6 +4677,10 @@ static int cam_icp_process_generic_cmd_buffer(
cmd_desc = (struct cam_cmd_buf_desc *)
((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);
for (i = 0; i < packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (!cmd_desc[i].length)
continue;
@ -4862,6 +4866,10 @@ static int cam_icp_mgr_config_stream_settings(
cmd_desc = (struct cam_cmd_buf_desc *)
((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);
rc = cam_packet_util_validate_cmd_desc(cmd_desc);
if (rc)
return rc;
if (!cmd_desc[0].length ||
cmd_desc[0].meta_data != CAM_ICP_CMD_META_GENERIC_BLOB) {
CAM_ERR(CAM_ICP, "Invalid cmd buffer length/metadata");

4
techpack/camera/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
View File

@ -155,6 +155,10 @@ static int cam_ife_mgr_handle_reg_dump(struct cam_ife_hw_mgr_ctx *ctx,
"Reg dump values might be from more than one request");
for (i = 0; i < num_reg_dump_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&reg_dump_buf_desc[i]);
if (rc)
return rc;
CAM_DBG(CAM_ISP, "Reg dump cmd meta data: %u req_type: %u",
reg_dump_buf_desc[i].meta_data, meta_type);
if (reg_dump_buf_desc[i].meta_data == meta_type) {

4
techpack/camera/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
View File

@ -284,6 +284,10 @@ int cam_isp_add_command_buffers(
split_id, prepare->packet->num_cmd_buf);
for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
num_ent = prepare->num_hw_update_entries;
if (!cmd_desc[i].length)
continue;

8
techpack/camera/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
View File

@ -123,6 +123,10 @@ static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet,
packet->cmd_buf_offset);
for (i = 0; i < packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (!cmd_desc[i].length)
continue;
@ -323,6 +327,10 @@ static int cam_lrme_mgr_util_prepare_hw_update_entries(
&prepare->packet->payload + prepare->packet->cmd_buf_offset);
for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (!cmd_desc[i].length)
continue;

32
techpack/camera/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
View File

@ -430,13 +430,17 @@ static void cam_ope_dump_dmi(struct cam_ope_hang_dump *dump, uint32_t addr,
static int cam_ope_mgr_put_cmd_buf(struct cam_packet *packet)
{
int i = 0;
int i = 0, rc = 0;
struct cam_cmd_buf_desc *cmd_desc = NULL;
cmd_desc = (struct cam_cmd_buf_desc *)
((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);
for (i = 0; i < packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
continue;
@ -444,7 +448,7 @@ static int cam_ope_mgr_put_cmd_buf(struct cam_packet *packet)
cam_mem_put_cpu_buf(cmd_desc[i].mem_handle);
}
return 0;
return rc;
}
static int cam_ope_dump_indirect(struct ope_cmd_buf_info *cmd_buf_info,
@ -558,6 +562,10 @@ static int cam_ope_dump_frame_process(struct cam_packet *packet,
cmd_desc = (struct cam_cmd_buf_desc *)
((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);
for (i = 0; i < packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
continue;
@ -2288,6 +2296,10 @@ static int cam_ope_mgr_process_cmd_desc(struct cam_ope_hw_mgr *hw_mgr,
*ope_cmd_buf_addr = 0;
for (i = 0; i < packet->num_cmd_buf; i++, num_cmd_buf++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (cmd_desc[i].type != CAM_CMD_BUF_GENERIC ||
cmd_desc[i].meta_data == OPE_CMD_META_GENERIC_BLOB)
continue;
@ -3179,16 +3191,20 @@ static int cam_ope_process_generic_cmd_buffer(
((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);
for (i = 0; i < packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (!cmd_desc[i].length)
continue;
if (cmd_desc[i].meta_data != OPE_CMD_META_GENERIC_BLOB)
continue;
if (cmd_desc[i].meta_data != OPE_CMD_META_GENERIC_BLOB)
continue;
rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
cam_ope_packet_generic_blob_handler, &cmd_generic_blob);
if (rc)
CAM_ERR(CAM_OPE, "Failed in processing blobs %d", rc);
rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
cam_ope_packet_generic_blob_handler, &cmd_generic_blob);
if (rc)
CAM_ERR(CAM_OPE, "Failed in processing blobs %d", rc);
}
return rc;

4
techpack/camera/drivers/cam_sensor_module/cam_actuator/cam_actuator_core.c
View File

@ -506,6 +506,10 @@ int32_t cam_actuator_i2c_pkt_parse(struct cam_actuator_ctrl_t *a_ctrl,
/* Loop through multiple command buffers */
for (i = 0; i < csl_packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
total_cmd_buf_in_bytes = cmd_desc[i].length;
if (!total_cmd_buf_in_bytes)
continue;

8
techpack/camera/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
View File

@ -734,6 +734,10 @@ static int32_t cam_eeprom_parse_write_memory_packet(
int master;
struct cam_sensor_cci_client *cci;
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
total_cmd_buf_in_bytes = cmd_desc[i].length;
processed_cmd_buf_in_bytes = 0;
@ -951,6 +955,10 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl,
/* Loop through multiple command buffers */
for (i = 0; i < csl_packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
total_cmd_buf_in_bytes = cmd_desc[i].length;
processed_cmd_buf_in_bytes = 0;
if (!total_cmd_buf_in_bytes)

4
techpack/camera/drivers/cam_sensor_module/cam_flash/cam_flash_core.c
View File

@ -1061,6 +1061,10 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
/* Loop through multiple command buffers */
for (i = 1; i < csl_packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
total_cmd_buf_in_bytes = cmd_desc[i].length;
processed_cmd_buf_in_bytes = 0;
if (!total_cmd_buf_in_bytes)

4
techpack/camera/drivers/cam_sensor_module/cam_ois/cam_ois_core.c
View File

@ -541,6 +541,10 @@ static int cam_ois_pkt_parse(struct cam_ois_ctrl_t *o_ctrl, void *arg)
/* Loop through multiple command buffers */
for (i = 0; i < csl_packet->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
total_cmd_buf_in_bytes = cmd_desc[i].length;
if (!total_cmd_buf_in_bytes)
continue;

4
techpack/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
View File

@ -555,6 +555,10 @@ int32_t cam_handle_mem_ptr(uint64_t handle, struct cam_sensor_ctrl_t *s_ctrl)
}
for (i = 0; i < pkt->num_cmd_buf; i++) {
rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
if (rc)
return rc;
if (!(cmd_desc[i].length))
continue;
rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,