Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8412327d authored by jinguiw's avatar jinguiw
Browse files

msm: camera: icp: io buf config num validation 



There are only limitations for CAM_BUF_IN and CAM_BUF_OUT in
config validation, but there will be CAM_BUF_IN_OUT type also.
In process io config, both CAM_BUF_OUT and CAM_BUF_IN_OUT types
are in out_map_entries. No limitation for CAM_BUF_IN_OUT will
lead to out of bound for out_map_entries. This change adds check
for num of io config need in out_map_entries to avoid
out of bound risk.

CRs-Fixed: 3857308
Change-Id: I69163a4264d226d617cbe4f37ba1deb4e6434e31
Signed-off-by: default avatarjinguiw <quic_jinguiw@quicinc.com>
parent 63445d10

drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+10 −2
Original line number Diff line number Diff line
@@ -4189,7 +4189,8 @@ static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet) 
					packet->io_configs_offset/4);



	for (i = 0 ; i < packet->num_io_configs; i++)

		if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)

		if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||

			(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT))

			num_out_map_entries++;



	if (num_out_map_entries <= CAM_MAX_OUT_RES) {
@@ -4342,10 +4343,17 @@ static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr, 
		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT) {

			sync_in_obj[j++] = io_cfg_ptr[i].fence;

			prepare_args->num_in_map_entries++;

		} else {

		} else if ((io_cfg_ptr[i].direction == CAM_BUF_OUTPUT) ||

			(io_cfg_ptr[i].direction == CAM_BUF_IN_OUT)) {

			prepare_args->out_map_entries[k++].sync_id =

				io_cfg_ptr[i].fence;

			prepare_args->num_out_map_entries++;

		} else {

			CAM_ERR(CAM_ICP, "dir: %d, max_out:%u, out %u",

				io_cfg_ptr[i].direction,

				prepare_args->max_out_map_entries,

				prepare_args->num_out_map_entries);

			return -EINVAL;

		}

		CAM_DBG(CAM_REQ,

			"ctx_id: %u req_id: %llu dir[%d]: %u, fence: %u resource_type = %u memh %x",