Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 800f947c authored by Raja Mallik's avatar Raja Mallik
Browse files

sm: camera: lrme: Fix Stack Overflow condition in lrme hw manager 



Add error check for condition where array index is equal to the max
permissible io buffers for lrme which causes stack overflow.

Change-Id: Ifdf71516e5b8c269edca9965588d7e4fa0d940ff
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
Signed-off-by: default avatarRaja Mallik <rmallik@codeaurora.org>
parent 74195788

drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+12 −7
Original line number Diff line number Diff line
@@ -167,13 +167,6 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			io_cfg[i].resource_type,

			io_cfg[i].fence, io_cfg[i].format);



		if ((num_in_buf > io_buf_size) ||

			(num_out_buf > io_buf_size)) {

			CAM_ERR(CAM_LRME, "Invalid number of buffers %d %d %d",

				num_in_buf, num_out_buf, io_buf_size);

			return -EINVAL;

		}



		memset(io_addr, 0, sizeof(io_addr));

		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {

			if (!io_cfg[i].mem_handle[plane])
@@ -201,6 +194,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 


		switch (io_cfg[i].direction) {

		case CAM_BUF_INPUT: {

			if (num_in_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->in_map_entries[num_in_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->in_map_entries[num_in_buf].sync_id =
@@ -216,6 +215,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			break;

		}

		case CAM_BUF_OUTPUT: {

			if (num_out_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->out_map_entries[num_out_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->out_map_entries[num_out_buf].sync_id =

drivers/media/platform/msm/camera_v3/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+12 −7
Original line number Diff line number Diff line
@@ -167,13 +167,6 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			io_cfg[i].resource_type,

			io_cfg[i].fence, io_cfg[i].format);



		if ((num_in_buf > io_buf_size) ||

			(num_out_buf > io_buf_size)) {

			CAM_ERR(CAM_LRME, "Invalid number of buffers %d %d %d",

				num_in_buf, num_out_buf, io_buf_size);

			return -EINVAL;

		}



		memset(io_addr, 0, sizeof(io_addr));

		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {

			if (!io_cfg[i].mem_handle[plane])
@@ -201,6 +194,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 


		switch (io_cfg[i].direction) {

		case CAM_BUF_INPUT: {

			if (num_in_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->in_map_entries[num_in_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->in_map_entries[num_in_buf].sync_id =
@@ -216,6 +215,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			break;

		}

		case CAM_BUF_OUTPUT: {

			if (num_out_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->out_map_entries[num_out_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->out_map_entries[num_out_buf].sync_id =