Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5685ecf2 authored by Ashish Bhimanpalliwar's avatar Ashish Bhimanpalliwar Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: common: Add conditions to catch invalid packet data 



Add conditions to catch invalid cmd_desc, io buffers, and kmd buffers in
the packet payload.

CRs-Fixed: 3250331
Change-Id: I2db474572a8c5391ba9b9821de2da0db8f10eb4d
Signed-off-by: default avatarAshish Bhimanpalliwar <quic_abhiman@quicinc.com>
parent a2b2dfab

drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c

+2 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/module.h>
@@ -54,7 +55,7 @@ static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet, 
	}



	/* All buffers must come through io config, do not support patching */

	if (packet->num_patches || !packet->num_io_configs) {

	if (packet->num_patches || !packet->num_io_configs || !packet->num_cmd_buf) {

		CAM_ERR(CAM_FD, "wrong number of cmd/patch info: %u %u",

			packet->num_cmd_buf, packet->num_patches);

		return -EINVAL;

drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+2 −2
Original line number Diff line number Diff line
@@ -4189,13 +4189,13 @@ static int cam_icp_mgr_pkt_validation(struct cam_packet *packet) 
		return -EINVAL;

	}



	if (packet->num_io_configs > IPE_IO_IMAGES_MAX) {

	if (!packet->num_io_configs || packet->num_io_configs > IPE_IO_IMAGES_MAX) {

		CAM_ERR(CAM_ICP, "Invalid number of io configs: %d %d",

			IPE_IO_IMAGES_MAX, packet->num_io_configs);

		return -EINVAL;

	}



	if (packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {

	if (!packet->num_cmd_buf || packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) {

		CAM_ERR(CAM_ICP, "Invalid number of cmd buffers: %d %d",

			CAM_ICP_CTX_MAX_CMD_BUFFERS, packet->num_cmd_buf);

		return -EINVAL;

drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

+4 −3
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/uaccess.h>
@@ -769,8 +769,9 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, 
		return rc;

	}



	if ((packet->num_cmd_buf > 5) || !packet->num_patches ||

		!packet->num_io_configs ||

	if (!packet->num_cmd_buf ||

		(packet->num_cmd_buf > 5) ||

		!packet->num_patches || !packet->num_io_configs ||

		(packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) {

		CAM_ERR(CAM_JPEG,

			"wrong number of cmd/patch/io_configs info: %u %u %u",

drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+6 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/module.h>
@@ -113,6 +114,11 @@ static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet, 
		return -EINVAL;

	}



	if (!packet->num_cmd_buf) {

		CAM_ERR(CAM_LRME, "no cmd bufs");

		return -EINVAL;

	}



	cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)&packet->payload +

		packet->cmd_buf_offset);

drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c

+4 −2
Original line number Diff line number Diff line
@@ -2379,13 +2379,15 @@ static int cam_ope_mgr_pkt_validation(struct cam_packet *packet) 
		return -EINVAL;

	}



	if (packet->num_io_configs > OPE_MAX_IO_BUFS) {

	if (!packet->num_io_configs ||

		packet->num_io_configs > OPE_MAX_IO_BUFS) {

		CAM_ERR(CAM_OPE, "Invalid number of io configs: %d %d",

			OPE_MAX_IO_BUFS, packet->num_io_configs);

		return -EINVAL;

	}



	if (packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) {

	if (!packet->num_cmd_buf ||

		packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) {

		CAM_ERR(CAM_OPE, "Invalid number of cmd buffers: %d %d",

			OPE_PACKET_MAX_CMD_BUFS, packet->num_cmd_buf);

		return -EINVAL;