Merge "msm: isp: ISP driver potential outof bound fixes" (cae0d941) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1374,7 +1374,8 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev,
		msm_isp_axi_stream_enable_cfg(vfe_dev, stream_info);
		stream_info->state = ACTIVE;
		}
		if (SRC_TO_INTF(stream_info->stream_src) != VFE_PIX_0) {
		if (SRC_TO_INTF(stream_info->stream_src) != VFE_PIX_0 &&
		stream_info->stream_src < VFE_AXI_SRC_MAX) {
		vfe_dev->axi_data.src_info[SRC_TO_INTF(
		stream_info->stream_src)].frame_id = 0;
		}

+1 −1

Original line number	Diff line number	Diff line
		@@ -28,7 +28,7 @@ static int msm_isp_stats_cfg_ping_pong_address(struct vfe_device *vfe_dev,
		uint32_t stats_idx = STATS_IDX(stream_info->stream_handle);

		if (stats_idx >= vfe_dev->hw_info->stats_hw_info->num_stats_type \|\|
		stats_idx > MSM_ISP_STATS_MAX) {
		stats_idx >= MSM_ISP_STATS_MAX) {
		pr_err("%s Invalid stats index %d", __func__, stats_idx);
		return -EINVAL;
		}

+5 −1

Original line number	Diff line number	Diff line
		@@ -160,6 +160,10 @@ int msm_isp_update_bandwidth(enum msm_isp_hw_client client,

		void msm_isp_deinit_bandwidth_mgr(enum msm_isp_hw_client client)
		{
		if (client >= MAX_ISP_CLIENT) {
		pr_err("invalid Client id %d", client);
		return;
		}
		mutex_lock(&bandwidth_mgr_mutex);
		memset(&isp_bandwidth_mgr.client_info[client], 0,
		sizeof(struct msm_isp_bandwidth_info));
		@@ -549,7 +553,7 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device vfe_dev, void arg)
		break;
		}
		if (copy_from_user(&cmd_next, compat_ptr(cmd.next),
		sizeof(struct msm_vfe_cfg_cmd_list))) {
		sizeof(struct msm_vfe_cfg_cmd_list_32))) {
		rc = -EFAULT;
		continue;
		}