android/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "msm: camera: ope: check cpu buffer offset and cmd buf idx" into camera-kernel.lnx.7.0

Browse Source
This commit is contained in:
cheese Service 2024-07-26 02:37:47 -07:00 committed by Gerrit - the friendly Code Review server
commit 47d88e467c
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
View File

@ -2212,6 +2212,14 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
hw_mgr->iommu_hdl);
goto end;
}
if ((len <= frame_process->cmd_buf[i][j].offset) ||
(frame_process->cmd_buf[i][j].size <
frame_process->cmd_buf[i][j].length) ||
((len - frame_process->cmd_buf[i][j].offset) <
frame_process->cmd_buf[i][j].length)) {
CAM_ERR(CAM_OPE, "Invalid offset.");
return -EINVAL;
}
cpu_addr = cpu_addr +
frame_process->cmd_buf[i][j].offset;
CAM_DBG(CAM_OPE, "Hdl %x size %d len %d off %d",
@ -2260,6 +2268,10 @@ static int cam_ope_mgr_process_cmd_buf_req(struct cam_ope_hw_mgr *hw_mgr,
uint32_t s_idx = 0;
s_idx = cmd_buf->stripe_idx;
if (s_idx < 0 || s_idx >= OPE_MAX_STRIPES) {
CAM_ERR(CAM_OPE, "Invalid index.");
return -EINVAL;
}
num_cmd_bufs =
ope_request->num_stripe_cmd_bufs[i][s_idx];