Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 269ccc9b authored by E V Ravi's avatar E V Ravi
Browse files

msm: ais: lrme: Fix Stack Overflow condition in lrme hw manager 



Add error check for condition where array index is equal to the max
permissible io buffers for lrme which causes stack overflow.

Change-Id: I5d05faae8350f4f35e55c50b1195123cac126e37
Signed-off-by: default avatarE V Ravi <evenka@codeaurora.org>
parent c0ba827d

drivers/media/platform/msm/ais/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+13 −8
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -166,13 +166,6 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			io_cfg[i].resource_type,

			io_cfg[i].fence, io_cfg[i].format);



		if ((num_in_buf > io_buf_size) ||

			(num_out_buf > io_buf_size)) {

			CAM_ERR(CAM_LRME, "Invalid number of buffers %d %d %d",

				num_in_buf, num_out_buf, io_buf_size);

			return -EINVAL;

		}



		memset(io_addr, 0, sizeof(io_addr));

		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {

			if (!io_cfg[i].mem_handle[plane])
@@ -194,6 +187,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 


		switch (io_cfg[i].direction) {

		case CAM_BUF_INPUT: {

			if (num_in_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->in_map_entries[num_in_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->in_map_entries[num_in_buf].sync_id =
@@ -209,6 +208,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			break;

		}

		case CAM_BUF_OUTPUT: {

			if (num_out_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->out_map_entries[num_out_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->out_map_entries[num_out_buf].sync_id =