android/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "msm: camera: isp: Fix incorrect offset validation in __cam_isp_ctx_dump_in_top_state" into camera-kernel.lnx.7.0

Browse Source
This commit is contained in:
cheese Service 2024-07-26 02:36:28 -07:00 committed by Gerrit - the friendly Code Review server
commit 7e37e05f59
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/cam_isp/cam_isp_context.c
View File

@ -5598,10 +5598,10 @@ hw_dump:
(CAM_ISP_CTX_DUMP_NUM_WORDS * sizeof(uint64_t));
if (remain_len < min_len) {
spin_unlock_bh(&ctx->lock);
CAM_WARN(CAM_ISP,
"Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
spin_unlock_bh(&ctx->lock);
cam_mem_put_cpu_buf(dump_info->buf_handle);
return -ENOSPC;
}
@ -5635,6 +5635,18 @@ hw_dump:
}
dump_info->offset = dump_args.offset;
min_len = sizeof(struct cam_isp_context_dump_header) +
(CAM_ISP_CTX_DUMP_NUM_WORDS * sizeof(int32_t));
remain_len = buf_len - dump_info->offset;
if (remain_len < min_len) {
CAM_WARN(CAM_ISP,
"Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
spin_unlock_bh(&ctx->lock);
cam_mem_put_cpu_buf(dump_info->buf_handle);
return -ENOSPC;
}
/* Dump stream info */
ctx->ctxt_to_hw_map = ctx_isp->hw_ctx;
if (ctx->hw_mgr_intf->hw_dump) {
@ -5649,6 +5661,17 @@ hw_dump:
goto end;
}
dump_info->offset = dump_args.offset;
remain_len = buf_len - dump_info->offset;
if (remain_len < min_len) {
CAM_WARN(CAM_ISP,
"Dump buffer exhaust remain %zu min %u, ctx_idx: %u, link: 0x%x",
remain_len, min_len, ctx->ctx_id, ctx->link_hdl);
spin_unlock_bh(&ctx->lock);
cam_mem_put_cpu_buf(dump_info->buf_handle);
return -ENOSPC;
}
/* Dump second part of stream info from ife hw manager */
hw_cmd_args.ctxt_to_hw_map = ctx->ctxt_to_hw_map;
hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;