Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25dee60a authored by VijayaKumar T M's avatar VijayaKumar T M Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Add check to ensure task wont hog CPU 



In case the userspace code manipulates the list to be circular
This way the task will hog the CPU in while loop.

CRs-Fixed: 1064608
Change-Id: Ie896fd3da326e5e972266d8004baecf8681aea6d
Signed-off-by: default avatarVijayaKumar T M <vtmuni@codeaurora.org>
Signed-off-by: default avatarLokesh Kumar Aakulu <lkumar@codeaurora.org>
parent ac8bbe8c

drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c

+15 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include "trace/events/msm_cam.h"



#define MAX_ISP_V4l2_EVENTS 100

#define MAX_ISP_REG_LIST 100

static DEFINE_MUTEX(bandwidth_mgr_mutex);

static struct msm_isp_bandwidth_mgr isp_bandwidth_mgr;
@@ -642,6 +643,7 @@ static int msm_isp_set_dual_HW_master_slave_mode( 
static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg)

{

	int rc = 0;

	uint32_t count = 0;

	struct msm_vfe_cfg_cmd_list *proc_cmd =

		(struct msm_vfe_cfg_cmd_list *)arg;

	struct msm_vfe_cfg_cmd_list cmd, cmd_next;
@@ -665,6 +667,12 @@ static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) 
				sizeof(struct msm_vfe_cfg_cmd_list));

			break;

		}

		if (++count >= MAX_ISP_REG_LIST) {

			pr_err("%s:%d Error exceeding the max register count:%u\n",

				__func__, __LINE__, count);

			rc = -EFAULT;

			break;

		}

		if (copy_from_user(&cmd_next, (void __user *)cmd.next,

			sizeof(struct msm_vfe_cfg_cmd_list))) {

			rc = -EFAULT;
@@ -711,6 +719,7 @@ static void msm_isp_compat_to_proc_cmd(struct msm_vfe_cfg_cmd2 *proc_cmd, 
static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg)

{

	int rc = 0;

	uint32_t count = 0;

	struct msm_vfe_cfg_cmd_list_32 *proc_cmd =

		(struct msm_vfe_cfg_cmd_list_32 *)arg;

	struct msm_vfe_cfg_cmd_list_32 cmd, cmd_next;
@@ -735,6 +744,12 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) 
				sizeof(struct msm_vfe_cfg_cmd_list));

			break;

		}

		if (++count >= MAX_ISP_REG_LIST) {

			pr_err("%s:%d Error exceeding the max register count:%u\n",

				__func__, __LINE__, count);

			rc = -EFAULT;

			break;

		}

		if (copy_from_user(&cmd_next, compat_ptr(cmd.next),

			sizeof(struct msm_vfe_cfg_cmd_list_32))) {

			rc = -EFAULT;