Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78d4608b authored by Rishabh Jain's avatar Rishabh Jain Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: core : Validate the dev name during the node ioctl handler 



Validate the context device name with node name. If device name is
not matching return the error.

Change-Id: I8dee4e6f64e17b0d1e486077a2c8b0df562a702e
Signed-off-by: default avatarRishabh Jain <risjai@codeaurora.org>
parent 926f041b

drivers/media/platform/msm/camera/cam_core/cam_context.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -454,7 +454,7 @@ int cam_context_init(struct cam_context *ctx, 
	mutex_init(&ctx->sync_mutex);

	spin_lock_init(&ctx->lock);



	ctx->dev_name = dev_name;

	strlcpy(ctx->dev_name, dev_name, CAM_CTX_DEV_NAME_MAX_LENGTH);

	ctx->dev_id = dev_id;

	ctx->ctx_id = ctx_id;

	ctx->ctx_crm_intf = NULL;

drivers/media/platform/msm/camera/cam_core/cam_context.h

+5 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -22,6 +22,9 @@ 
/* Forward declarations */

struct cam_context;



/* max device name string length*/

#define CAM_CTX_DEV_NAME_MAX_LENGTH 20



/* max request number */

#define CAM_CTX_REQ_MAX              20

#define CAM_CTX_CFG_MAX              20
@@ -179,7 +182,7 @@ struct cam_ctx_ops { 
 *

 */

struct cam_context {

	const char                  *dev_name;

	char                         dev_name[CAM_CTX_DEV_NAME_MAX_LENGTH];

	uint64_t                     dev_id;

	uint32_t                     ctx_id;

	struct list_head             list;

drivers/media/platform/msm/camera/cam_core/cam_node.c

+32 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -34,7 +34,7 @@ static void cam_node_print_ctx_state( 
		spin_lock(&ctx->lock);

		CAM_INFO(CAM_CORE,

			"[%s][%d] : state=%d, refcount=%d, active_req_list=%d, pending_req_list=%d, wait_req_list=%d, free_req_list=%d",

			ctx->dev_name ? ctx->dev_name : "null",

			ctx->dev_name,

			i, ctx->state,

			atomic_read(&(ctx->refcount.refcount)),

			list_empty(&ctx->active_req_list),
@@ -154,6 +154,12 @@ static int __cam_node_handle_start_dev(struct cam_node *node, 
		return -EINVAL;

	}



	if (strcmp(node->name, ctx->dev_name)) {

		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",

			node->name, ctx->dev_name);

		return -EINVAL;

	}



	rc = cam_context_handle_start_dev(ctx, start);

	if (rc)

		CAM_ERR(CAM_CORE, "Start failure for node %s", node->name);
@@ -187,6 +193,12 @@ static int __cam_node_handle_stop_dev(struct cam_node *node, 
		return -EINVAL;

	}



	if (strcmp(node->name, ctx->dev_name)) {

		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",

			node->name, ctx->dev_name);

		return -EINVAL;

	}



	rc = cam_context_handle_stop_dev(ctx, stop);

	if (rc)

		CAM_ERR(CAM_CORE, "Stop failure for node %s", node->name);
@@ -220,6 +232,12 @@ static int __cam_node_handle_config_dev(struct cam_node *node, 
		return -EINVAL;

	}



	if (strcmp(node->name, ctx->dev_name)) {

		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",

			node->name, ctx->dev_name);

		return -EINVAL;

	}



	rc = cam_context_handle_config_dev(ctx, config);

	if (rc)

		CAM_ERR(CAM_CORE, "Config failure for node %s", node->name);
@@ -253,6 +271,12 @@ static int __cam_node_handle_flush_dev(struct cam_node *node, 
		return -EINVAL;

	}



	if (strcmp(node->name, ctx->dev_name)) {

		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",

			node->name, ctx->dev_name);

		return -EINVAL;

	}



	rc = cam_context_handle_flush_dev(ctx, flush);

	if (rc)

		CAM_ERR(CAM_CORE, "Flush failure for node %s", node->name);
@@ -286,6 +310,12 @@ static int __cam_node_handle_release_dev(struct cam_node *node, 
		return -EINVAL;

	}



	if (strcmp(node->name, ctx->dev_name)) {

		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",

			node->name, ctx->dev_name);

		return -EINVAL;

	}



	if (ctx->state > CAM_CTX_UNINIT && ctx->state < CAM_CTX_STATE_MAX) {

		rc = cam_context_handle_release_dev(ctx, release);

		if (rc)

drivers/media/platform/msm/camera/cam_core/cam_node.h

+2 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -18,7 +18,6 @@ 
#include "cam_hw_mgr_intf.h"

#include "cam_req_mgr_interface.h"



#define CAM_NODE_NAME_LENGTH_MAX        256



#define CAM_NODE_STATE_UNINIT           0

#define CAM_NODE_STATE_INIT             1
@@ -38,7 +37,7 @@ 
 *

 */

struct cam_node {

	char                         name[CAM_NODE_NAME_LENGTH_MAX];

	char                         name[CAM_CTX_DEV_NAME_MAX_LENGTH];

	uint32_t                     state;



	/* context pool */

drivers/media/platform/msm/camera/cam_fd/cam_fd_context.c

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -17,7 +17,7 @@ 
#include "cam_fd_context.h"

#include "cam_trace.h"



static const char fd_dev_name[] = "fd";

static const char fd_dev_name[] = "cam-fd";



/* Functions in Available state */

static int __cam_fd_ctx_acquire_dev_in_available(struct cam_context *ctx,