Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c441c3c authored by Suresh Vankadara's avatar Suresh Vankadara
Browse files

msm: camera: Fix for invalid kernel memory access 



adjust the length of the command based on command type
to avoid invalid memory access in ISP driver.

Change-Id: I11d608b12a5fdd27cdc29cb8f08ffc4fa4b46125
CRs-Fixed: 567596
Signed-off-by: default avatarSuresh Vankadara <svankada@codeaurora.org>
parent f5edc513

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+3 −1
Original line number Diff line number Diff line
@@ -511,7 +511,9 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, 
		}

		lo_tbl_ptr = cfg_data +

			reg_cfg_cmd->u.dmi_info.lo_tbl_offset/4;



		if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_64BIT)

			reg_cfg_cmd->u.dmi_info.len =

				reg_cfg_cmd->u.dmi_info.len / 2;

		for (i = 0; i < reg_cfg_cmd->u.dmi_info.len/4; i++) {

			lo_val = *lo_tbl_ptr++;

			if (reg_cfg_cmd->cmd_type == VFE_WRITE_DMI_16BIT) {