Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d4d0a81 authored by Senthil's avatar Senthil Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Fix 64bit DMI tbl write len check 



The hi table offset check during 64 bit DMI table writing
is off by 1 4-byte word, causing valid reads or writes to fail
if DMI payload end is the same as the command buffer end.

Change-Id: I7d193f36dfa1f10d92f0447524803dd749fa6663
Signed-off-by: default avatarSenthil <skrajago@codeaurora.org>
parent 609c8181

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+6 −3
Original line number Diff line number Diff line
@@ -795,9 +795,11 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, 
		uint32_t hi_val, lo_val, lo_val1;

		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT) {

			if ((UINT_MAX - reg_cfg_cmd->u.dmi_info.hi_tbl_offset <

						reg_cfg_cmd->u.dmi_info.len) ||

						reg_cfg_cmd->u.dmi_info.len -

						sizeof(uint32_t)) ||

				(reg_cfg_cmd->u.dmi_info.hi_tbl_offset +

				reg_cfg_cmd->u.dmi_info.len > cmd_len)) {

				reg_cfg_cmd->u.dmi_info.len -

					sizeof(uint32_t) > cmd_len)) {

				pr_err("Invalid Hi Table out of bounds\n");

				return -EINVAL;

			}
@@ -843,7 +845,8 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, 
		uint32_t hi_val, lo_val, lo_val1;

		if (reg_cfg_cmd->cmd_type == VFE_READ_DMI_64BIT) {

			if (reg_cfg_cmd->u.dmi_info.hi_tbl_offset +

				reg_cfg_cmd->u.dmi_info.len > cmd_len) {

				reg_cfg_cmd->u.dmi_info.len -

					sizeof(uint32_t) > cmd_len) {

				pr_err("Invalid Hi Table out of bounds\n");

				return -EINVAL;

			}