Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6aed441c authored by Alok Pandey's avatar Alok Pandey Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: icp: KW work issue in ICP 



During packet preprocessing, if packet has no command buffers
it will lead to dereferencing null address. Similarly, during
io patching, null or garbage address may be used.
This change initializes the address and applies null check
while accessing it.

Change-Id: I116928aeed05eb897a5a557d71724110628a9a70
Signed-off-by: default avatarAlok Pandey <akumarpa@codeaurora.org>
parent 7d14115d

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+5 −0
Original line number Diff line number Diff line
@@ -3400,6 +3400,11 @@ static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr, 
		}

	}



	if (!cpu_addr) {

		CAM_ERR(CAM_ICP, "invalid number of cmd buf");

		return -EINVAL;

	}



	if (ctx_data->icp_dev_acquire_info->dev_type !=

		CAM_ICP_RES_TYPE_BPS) {

		CAM_DBG(CAM_ICP, "cpu addr = %zx", cpu_addr);

drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c

+3 −3
Original line number Diff line number Diff line
@@ -134,7 +134,7 @@ int cam_packet_util_process_patches(struct cam_packet *packet, 
{

	struct cam_patch_desc *patch_desc = NULL;

	dma_addr_t iova_addr;

	uintptr_t  cpu_addr;

	uintptr_t  cpu_addr = 0;

	uint32_t   temp;

	uint32_t  *dst_cpu_addr;

	uint32_t  *src_buf_iova_addr;
@@ -166,7 +166,7 @@ int cam_packet_util_process_patches(struct cam_packet *packet, 


		rc = cam_mem_get_cpu_buf(patch_desc[i].dst_buf_hdl,

			&cpu_addr, &dst_buf_len);

		if (rc < 0) {

		if (rc < 0 || !cpu_addr || (dst_buf_len == 0)) {

			CAM_ERR(CAM_UTIL, "unable to get dst buf address");

			return rc;

		}
@@ -199,7 +199,7 @@ int cam_packet_util_process_generic_cmd_buffer( 
	cam_packet_generic_blob_handler blob_handler_cb, void *user_data)

{

	int       rc;

	uintptr_t  cpu_addr;

	uintptr_t  cpu_addr = 0;

	size_t    buf_size;

	uint32_t *blob_ptr;

	uint32_t  blob_type, blob_size, blob_block_size, len_read;