Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 235f2967 authored by Trishansh Bhardwaj's avatar Trishansh Bhardwaj Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: common: Fix integer overflow in shift 



Various drivers are using right shift  by 32 to check if dma address is
32 bit addressable. This will result in shift count overflow in 32 bit
arch.

CRs-Fixed: 2543730
Change-Id: I57e30bc9c0a8179c8d74f3bd3b6567bdfff60741
Signed-off-by: default avatarTrishansh Bhardwaj <tbhardwa@codeaurora.org>
parent f4473f65

drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+1 −1
Original line number Diff line number Diff line
@@ -4490,7 +4490,7 @@ static void cam_icp_mgr_print_io_bufs(struct cam_packet *packet, 
					"get src buf address fail rc %d", rc);

				continue;

			}

			if (iova_addr >> 32) {

			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {

				CAM_ERR(CAM_ICP, "Invalid mapped address");

				rc = -EINVAL;

				continue;

drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

+1 −1
Original line number Diff line number Diff line
@@ -5707,7 +5707,7 @@ static void cam_ife_mgr_print_io_bufs(struct cam_packet *packet, 
					io_cfg[i].mem_handle[j]);

				continue;

			}

			if (iova_addr >> 32) {

			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {

				CAM_ERR(CAM_ISP, "Invalid mapped address");

				rc = -EINVAL;

				continue;

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

+1 −1
Original line number Diff line number Diff line
@@ -660,7 +660,7 @@ static void cam_jpeg_mgr_print_io_bufs(struct cam_packet *packet, 
				CAM_ERR(CAM_UTIL, "get src buf address fail");

				continue;

			}

			if (iova_addr >> 32) {

			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {

				CAM_ERR(CAM_JPEG, "Invalid mapped address");

				rc = -EINVAL;

				continue;