Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b22d7113 authored by Abhilash Kumar's avatar Abhilash Kumar Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: icp: Add packet validation 



Check number of command buffers and IO config buffers
before processing a packet to avoid invalid accessing
buffers.

Change-Id: Idc663c47841270e5b163813ec1d423fd8705e1e5
Signed-off-by: default avatarSuresh Vankadara <svankada@codeaurora.org>
Signed-off-by: default avatarAbhilash Kumar <krabhi@codeaurora.org>
parent 72069bdc

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+17 −2
Original line number Diff line number Diff line
@@ -2862,8 +2862,23 @@ static int cam_icp_mgr_pkt_validation(struct cam_packet *packet) 
			packet->header.op_code & 0xff);

		return -EINVAL;

	}

	CAM_DBG(CAM_ICP, "number of cmd/patch info: %u %u",

			packet->num_cmd_buf, packet->num_patches);



	if (packet->num_io_configs > IPE_IO_IMAGES_MAX) {

		CAM_ERR(CAM_ICP, "Invalid number of io configs: %d %d",

			IPE_IO_IMAGES_MAX, packet->num_io_configs);

		return -EINVAL;

	}



	if (packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {

		CAM_ERR(CAM_ICP, "Invalid number of cmd buffers: %d %d",

			CAM_ICP_CTX_MAX_CMD_BUFFERS, packet->num_cmd_buf);

		return -EINVAL;

	}



	CAM_DBG(CAM_ICP, "number of cmd/patch info: %u %u %u %u",

			packet->num_cmd_buf,

			packet->num_io_configs, IPE_IO_IMAGES_MAX,

			packet->num_patches);

	return 0;

}

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h

+2 −0
Original line number Diff line number Diff line
@@ -68,6 +68,8 @@ 
#define CAM_ICP_CTX_STATE_ACQUIRED  0x2

#define CAM_ICP_CTX_STATE_RELEASE   0x3



#define CAM_ICP_CTX_MAX_CMD_BUFFERS 0x2



/**

 * struct icp_hfi_mem_info

 * @qtbl: Memory info of queue table