Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31016890 authored by Senthil kumar Rajagopal's avatar Senthil kumar Rajagopal
Browse files

msm: isp: ISP driver potential outof bound fixes 



fix for potential out of bound values
in the array

Change-Id: Ib3a25e4f40757e0ca4a33c91506350a519044d12
Signed-off-by: default avatarSenthil kumar Rajagopal <skrajago@codeaurora.org>
parent 82f65cf9

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+2 −1
Original line number Diff line number Diff line
@@ -1262,7 +1262,8 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev, 
			msm_isp_axi_stream_enable_cfg(vfe_dev, stream_info);

			stream_info->state = ACTIVE;

		}

		if (SRC_TO_INTF(stream_info->stream_src) != VFE_PIX_0) {

		if (SRC_TO_INTF(stream_info->stream_src) != VFE_PIX_0 &&

			stream_info->stream_src < VFE_AXI_SRC_MAX) {

			vfe_dev->axi_data.src_info[SRC_TO_INTF(

				stream_info->stream_src)].frame_id = 0;

		}

drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c

+1 −1
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ static int msm_isp_stats_cfg_ping_pong_address(struct vfe_device *vfe_dev, 
	uint32_t stats_idx = STATS_IDX(stream_info->stream_handle);



	if (stats_idx >= vfe_dev->hw_info->stats_hw_info->num_stats_type ||

		stats_idx > MSM_ISP_STATS_MAX) {

		stats_idx >= MSM_ISP_STATS_MAX) {

		pr_err("%s Invalid stats index %d", __func__, stats_idx);

		return -EINVAL;

	}

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+5 −1
Original line number Diff line number Diff line
@@ -160,6 +160,10 @@ int msm_isp_update_bandwidth(enum msm_isp_hw_client client, 


void msm_isp_deinit_bandwidth_mgr(enum msm_isp_hw_client client)

{

	if (client >= MAX_ISP_CLIENT) {

		pr_err("invalid Client id %d", client);

		return;

	}

	mutex_lock(&bandwidth_mgr_mutex);

	memset(&isp_bandwidth_mgr.client_info[client], 0,

		   sizeof(struct msm_isp_bandwidth_info));
@@ -549,7 +553,7 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) 
			break;

		}

		if (copy_from_user(&cmd_next, compat_ptr(cmd.next),

			sizeof(struct msm_vfe_cfg_cmd_list))) {

			sizeof(struct msm_vfe_cfg_cmd_list_32))) {

			rc = -EFAULT;

			continue;

		}