Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec45b4db authored by Mukund Madhusudan Atre's avatar Mukund Madhusudan Atre
Browse files

msm: camera: lrme: Fix Stack Overflow condition in lrme hw manager 



Add error check for condition where array index is equal to the max
permissible io buffers for lrme which causes stack overflow.

Change-Id: Ifdf71516e5b8c269edca9965588d7e4fa0d940ff
Signed-off-by: default avatarMukund Madhusudan Atre <matre@codeaurora.org>
parent b0e2ff95

drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c

+13 −8
Original line number Diff line number Diff line 
/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -167,13 +167,6 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			io_cfg[i].resource_type,

			io_cfg[i].fence, io_cfg[i].format);



		if ((num_in_buf > io_buf_size) ||

			(num_out_buf > io_buf_size)) {

			CAM_ERR(CAM_LRME, "Invalid number of buffers %d %d %d",

				num_in_buf, num_out_buf, io_buf_size);

			return -EINVAL;

		}



		memset(io_addr, 0, sizeof(io_addr));

		for (plane = 0; plane < CAM_PACKET_MAX_PLANES; plane++) {

			if (!io_cfg[i].mem_handle[plane])
@@ -201,6 +194,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 


		switch (io_cfg[i].direction) {

		case CAM_BUF_INPUT: {

			if (num_in_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->in_map_entries[num_in_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->in_map_entries[num_in_buf].sync_id =
@@ -216,6 +215,12 @@ static int cam_lrme_mgr_util_prepare_io_buffer(int32_t iommu_hdl, 
			break;

		}

		case CAM_BUF_OUTPUT: {

			if (num_out_buf >= io_buf_size) {

				CAM_ERR(CAM_LRME,

					"Invalid number of buffers %d %d %d",

					num_in_buf, num_out_buf, io_buf_size);

				return -EINVAL;

			}

			prepare->out_map_entries[num_out_buf].resource_handle =

				io_cfg[i].resource_type;

			prepare->out_map_entries[num_out_buf].sync_id =