Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c01e2ad authored by Senthil's avatar Senthil
Browse files

msm: camera: isp: Fix integer overflow in vfe 46 



An intermediate calculation for size of AXI UB buffers results in
32bit overflow. This patch adds a 64bit calculation for temporary
result to avoid the overflow.

Change-Id: I3851437d91e6bf02c99d60d1f8eacf7e9d3b0489
Signed-off-by: default avatarSenthil <skrajago@codeaurora.org>
parent b8ee226d

drivers/media/platform/msm/camera_v2/isp/msm_isp46.c

+6 −5
Original line number Diff line number Diff line
@@ -923,7 +923,7 @@ static void msm_vfe46_cfg_axi_ub_equal_default( 
	uint8_t num_used_wms = 0;

	uint32_t prop_size = 0;

	uint32_t wm_ub_size;

	uint32_t delta;

	uint64_t delta;



	for (i = 0; i < axi_data->hw_info->num_wm; i++) {

		if (axi_data->free_wm[i] > 0) {
@@ -935,10 +935,11 @@ static void msm_vfe46_cfg_axi_ub_equal_default( 
		axi_data->hw_info->min_wm_ub * num_used_wms;

	for (i = 0; i < axi_data->hw_info->num_wm; i++) {

		if (axi_data->free_wm[i]) {

			delta =

				(axi_data->wm_image_size[i] *

					prop_size)/total_image_size;

			wm_ub_size = axi_data->hw_info->min_wm_ub + delta;

			delta = (uint64_t)axi_data->wm_image_size[i] *

					(uint64_t)prop_size;

			do_div(delta, total_image_size);

			wm_ub_size = axi_data->hw_info->min_wm_ub +

					(uint32_t)delta;

			msm_camera_io_w(ub_offset << 16 | (wm_ub_size - 1),

				vfe_dev->vfe_base + VFE46_WM_BASE(i) + 0x10);

			ub_offset += wm_ub_size;