Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 080219bb authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0' of... 

Merge tag 'LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel into android13-4.19-kona

"LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0"

* tag 'LA.UM.9.15.2.r1-10600-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
  msm: camera: memmgr: Remove the mutex lock for kref variable
  msm: camera: memmgr: Add refcount to track umd in use buffers
  msm: camera: sensor: Handling race condition in util api
  msm: camera: common: Fix possible OOB reads and writes operations

Change-Id: Ic30b7c9d5683965ee182c28681387a9725a83b17
parents 92fb1a2d 3c1a45b4

techpack/camera-bengal/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c

+9 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/module.h>
@@ -78,6 +78,10 @@ static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet, 
		packet->cmd_buf_offset);



	for (i = 0; i < packet->num_cmd_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);

		if (rc)

			return rc;



		/*

		 * We can allow 0 length cmd buffer. This can happen in case

		 * umd gives an empty cmd buffer as kmd buffer
@@ -789,6 +793,10 @@ static int cam_fd_mgr_util_prepare_hw_update_entries( 
		&prepare->packet->payload + prepare->packet->cmd_buf_offset);



	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);

		if (rc)

			return rc;



		if (!cmd_desc[i].length)

			continue;

techpack/camera-bengal/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+9 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/uaccess.h>
@@ -4596,6 +4596,10 @@ static int cam_icp_process_generic_cmd_buffer( 
	cmd_desc = (struct cam_cmd_buf_desc *)

		((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);

	for (i = 0; i < packet->num_cmd_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);

		if (rc)

			return rc;



		if (!cmd_desc[i].length)

			continue;
@@ -4781,6 +4785,10 @@ static int cam_icp_mgr_config_stream_settings( 
	cmd_desc = (struct cam_cmd_buf_desc *)

		((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);



	rc = cam_packet_util_validate_cmd_desc(cmd_desc);

	if (rc)

		return rc;



	if (!cmd_desc[0].length ||

		cmd_desc[0].meta_data != CAM_ICP_CMD_META_GENERIC_BLOB) {

		CAM_ERR(CAM_ICP, "Invalid cmd buffer length/metadata");

techpack/camera-bengal/drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

+5 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/slab.h>
@@ -154,6 +154,10 @@ static int cam_ife_mgr_handle_reg_dump(struct cam_ife_hw_mgr_ctx *ctx, 
			"Reg dump values might be from more than one request");



	for (i = 0; i < num_reg_dump_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&reg_dump_buf_desc[i]);

		if (rc)

			return rc;



		CAM_DBG(CAM_ISP, "Reg dump cmd meta data: %u req_type: %u",

			reg_dump_buf_desc[i].meta_data, meta_type);

		if (reg_dump_buf_desc[i].meta_data == meta_type) {

techpack/camera-bengal/drivers/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c

+5 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <media/cam_defs.h>
@@ -283,6 +283,10 @@ int cam_isp_add_command_buffers( 
		split_id, prepare->packet->num_cmd_buf);



	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);

		if (rc)

			return rc;



		num_ent = prepare->num_hw_update_entries;

		if (!cmd_desc[i].length)

			continue;

techpack/camera-bengal/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+9 −1
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.

 */



#include <linux/module.h>
@@ -117,6 +117,10 @@ static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet, 
		packet->cmd_buf_offset);



	for (i = 0; i < packet->num_cmd_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);

		if (rc)

			return rc;



		if (!cmd_desc[i].length)

			continue;
@@ -317,6 +321,10 @@ static int cam_lrme_mgr_util_prepare_hw_update_entries( 
		&prepare->packet->payload + prepare->packet->cmd_buf_offset);



	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {

		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);

		if (rc)

			return rc;



		if (!cmd_desc[i].length)

			continue;