Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd58038a authored by Venu Yeshala's avatar Venu Yeshala Committed by Gerrit - the friendly Code Review server
Browse files

Revert "msm: camera: isp: Check bounds for ISP command parameters" 



This reverts commit 09c3b0c0 since
it causes green screen issue in camera.

Change-Id: If3f93435068f883ab3c835181ae091a283d9f6e7
Signed-off-by: default avatarVenu Yeshala <vyeshala@codeaurora.org>
parent d5e312a9

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+15 −21
Original line number Diff line number Diff line
@@ -1230,9 +1230,8 @@ int msm_isp_proc_cmd(struct vfe_device *vfe_dev, void *arg) 
	struct msm_vfe_reg_cfg_cmd *reg_cfg_cmd;

	uint32_t *cfg_data = NULL;



	if (!proc_cmd->num_cfg ||

		proc_cmd->num_cfg > USHRT_MAX) {

		pr_err("%s: Invalid num_cfg %u\n", __func__, proc_cmd->num_cfg);

	if (!proc_cmd->num_cfg) {

		pr_err("%s: Passed num_cfg as 0\n", __func__);

		return -EINVAL;

	}
@@ -1251,13 +1250,7 @@ int msm_isp_proc_cmd(struct vfe_device *vfe_dev, void *arg) 
		goto copy_cmd_failed;

	}



	if (!proc_cmd->cmd_len ||

		proc_cmd->cmd_len > USHRT_MAX) {

		pr_err("%s: Invalid cmd_len %u\n", __func__, proc_cmd->cmd_len);

		rc = -EINVAL;

		goto cfg_data_failed;

	}



	if (proc_cmd->cmd_len > 0) {

		cfg_data = kzalloc(proc_cmd->cmd_len, GFP_KERNEL);

		if (!cfg_data) {

			pr_err("%s: cfg_data alloc failed\n", __func__);
@@ -1271,6 +1264,7 @@ int msm_isp_proc_cmd(struct vfe_device *vfe_dev, void *arg) 
			rc = -EFAULT;

			goto copy_cmd_failed;

		}

	}



	for (i = 0; i < proc_cmd->num_cfg; i++)

		rc = msm_isp_send_hw_cmd(vfe_dev, &reg_cfg_cmd[i],