Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9b70dba authored by Raja Mallik's avatar Raja Mallik Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera_v3: lrme: Fix Stack Overflow condition in lrme hw manager 



Add error check for condition where array index is equal to the max
permissible io buffers for lrme which causes stack overflow.

Change-Id: I489fdd41afb7796da907f58c20a1364b7f1f436d
Signed-off-by: default avatarRaja Mallik <rmallik@codeaurora.org>
parent bfd19ead

drivers/media/platform/msm/camera_v3/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+12 −7
Original line number Diff line number Diff line
@@ -167,13 +167,6 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			io_cfg[i].resource_type,

			io_cfg[i].fence, io_cfg[i].format);



		if ((num_in_buf > io_buf_size) ||

			(num_out_buf > io_buf_size)) {

			CAM_ERR(CAM_LRME, "Invalid number of buffers %d %d %d",

				num_in_buf, num_out_buf, io_buf_size);

			return -EINVAL;

		}



		memset(io_addr, 0, sizeof(io_addr));

		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {

			if (!io_cfg[i].mem_handle[plane])
@@ -201,6 +194,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 


		switch (io_cfg[i].direction) {

		case CAM_BUF_INPUT: {

			if (num_in_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->in_map_entries[num_in_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->in_map_entries[num_in_buf].sync_id =
@@ -216,6 +215,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			break;

		}

		case CAM_BUF_OUTPUT: {

			if (num_out_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->out_map_entries[num_out_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->out_map_entries[num_out_buf].sync_id =