Merge "msm: camera: icp: Add packet validation" into dev/msm-4.9-camx (ceef0a8a) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+17 −2

Original line number	Diff line number	Diff line
		@@ -2834,8 +2834,23 @@ static int cam_icp_mgr_pkt_validation(struct cam_packet *packet)
		packet->header.op_code & 0xff);
		return -EINVAL;
		}
		CAM_DBG(CAM_ICP, "number of cmd/patch info: %u %u",
		packet->num_cmd_buf, packet->num_patches);

		if (packet->num_io_configs > IPE_IO_IMAGES_MAX) {
		CAM_ERR(CAM_ICP, "Invalid number of io configs: %d %d",
		IPE_IO_IMAGES_MAX, packet->num_io_configs);
		return -EINVAL;
		}

		if (packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {
		CAM_ERR(CAM_ICP, "Invalid number of cmd buffers: %d %d",
		CAM_ICP_CTX_MAX_CMD_BUFFERS, packet->num_cmd_buf);
		return -EINVAL;
		}

		CAM_DBG(CAM_ICP, "number of cmd/patch info: %u %u %u %u",
		packet->num_cmd_buf,
		packet->num_io_configs, IPE_IO_IMAGES_MAX,
		packet->num_patches);
		return 0;
		}

+2 −0

Original line number	Diff line number	Diff line
		@@ -68,6 +68,8 @@
		#define CAM_ICP_CTX_STATE_ACQUIRED 0x2
		#define CAM_ICP_CTX_STATE_RELEASE 0x3

		#define CAM_ICP_CTX_MAX_CMD_BUFFERS 0x2

		/**
		* struct icp_hfi_mem_info
		* @qtbl: Memory info of queue table