Merge "msm: camera: core : Validate the dev name during the node ioctl handler" (b74643b8) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/camera/cam_core/cam_context.c

+2 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -454,7 +454,7 @@ int cam_context_init(struct cam_context *ctx,
		mutex_init(&ctx->sync_mutex);
		spin_lock_init(&ctx->lock);

		ctx->dev_name = dev_name;
		strlcpy(ctx->dev_name, dev_name, CAM_CTX_DEV_NAME_MAX_LENGTH);
		ctx->dev_id = dev_id;
		ctx->ctx_id = ctx_id;
		ctx->ctx_crm_intf = NULL;

drivers/media/platform/msm/camera/cam_core/cam_context.h

+5 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -22,6 +22,9 @@
		/* Forward declarations */
		struct cam_context;

		/* max device name string length*/
		#define CAM_CTX_DEV_NAME_MAX_LENGTH 20

		/* max request number */
		#define CAM_CTX_REQ_MAX 20
		#define CAM_CTX_CFG_MAX 20
		@@ -179,7 +182,7 @@ struct cam_ctx_ops {
		*
		*/
		struct cam_context {
		const char *dev_name;
		char dev_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
		uint64_t dev_id;
		uint32_t ctx_id;
		struct list_head list;

drivers/media/platform/msm/camera/cam_core/cam_node.c

+32 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -34,7 +34,7 @@ static void cam_node_print_ctx_state(
		spin_lock(&ctx->lock);
		CAM_INFO(CAM_CORE,
		"[%s][%d] : state=%d, refcount=%d, active_req_list=%d, pending_req_list=%d, wait_req_list=%d, free_req_list=%d",
		ctx->dev_name ? ctx->dev_name : "null",
		ctx->dev_name,
		i, ctx->state,
		atomic_read(&(ctx->refcount.refcount)),
		list_empty(&ctx->active_req_list),
		@@ -154,6 +154,12 @@ static int __cam_node_handle_start_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_start_dev(ctx, start);
		if (rc)
		CAM_ERR(CAM_CORE, "Start failure for node %s", node->name);
		@@ -187,6 +193,12 @@ static int __cam_node_handle_stop_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_stop_dev(ctx, stop);
		if (rc)
		CAM_ERR(CAM_CORE, "Stop failure for node %s", node->name);
		@@ -220,6 +232,12 @@ static int __cam_node_handle_config_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_config_dev(ctx, config);
		if (rc)
		CAM_ERR(CAM_CORE, "Config failure for node %s", node->name);
		@@ -253,6 +271,12 @@ static int __cam_node_handle_flush_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_flush_dev(ctx, flush);
		if (rc)
		CAM_ERR(CAM_CORE, "Flush failure for node %s", node->name);
		@@ -286,6 +310,12 @@ static int __cam_node_handle_release_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		if (ctx->state > CAM_CTX_UNINIT && ctx->state < CAM_CTX_STATE_MAX) {
		rc = cam_context_handle_release_dev(ctx, release);
		if (rc)

drivers/media/platform/msm/camera/cam_core/cam_node.h

+2 −3

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -18,7 +18,6 @@
		#include "cam_hw_mgr_intf.h"
		#include "cam_req_mgr_interface.h"

		#define CAM_NODE_NAME_LENGTH_MAX 256

		#define CAM_NODE_STATE_UNINIT 0
		#define CAM_NODE_STATE_INIT 1
		@@ -38,7 +37,7 @@
		*
		*/
		struct cam_node {
		char name[CAM_NODE_NAME_LENGTH_MAX];
		char name[CAM_CTX_DEV_NAME_MAX_LENGTH];
		uint32_t state;

		/* context pool */

drivers/media/platform/msm/camera/cam_fd/cam_fd_context.c

+2 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -17,7 +17,7 @@
		#include "cam_fd_context.h"
		#include "cam_trace.h"

		static const char fd_dev_name[] = "fd";
		static const char fd_dev_name[] = "cam-fd";

		/* Functions in Available state */
		static int __cam_fd_ctx_acquire_dev_in_available(struct cam_context *ctx,