Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f3df5c0 authored by Pratap Nirujogi's avatar Pratap Nirujogi Committed by VijayaKumar T M
Browse files

msm: camera: cpp: Check for valid tx level 



TX and RX FIFOs of Microcontroller are used to exchange commands
and messages between Micro FW and CPP driver. TX FIFO depth is
16 32-bit words, incase of errors there is a chance of overflow.
To prevent possible out of bound access, TX FIFO depth or
level is checked for MAX depth before accessing the FIFO.

Change-Id: I5adf39b46ff10e358c4a2c03a2de07d44b99cedb
Signed-off-by: default avatarPratap Nirujogi <pratapn@codeaurora.org>
Signed-off-by: default avatarVijayaKumar T M <vtmuni@codeaurora.org>
parent 7ed47c09

drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c

+10 −4
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -833,10 +833,15 @@ static irqreturn_t msm_cpp_irq(int irq_num, void *data) 
	if (irq_status & 0x8) {

		tx_level = msm_camera_io_r(cpp_dev->base +

			MSM_CPP_MICRO_FIFO_TX_STAT) >> 2;

		if (tx_level < MSM_CPP_TX_FIFO_LEVEL) {

			for (i = 0; i < tx_level; i++) {

				tx_fifo[i] = msm_camera_io_r(cpp_dev->base +

					MSM_CPP_MICRO_FIFO_TX_DATA);

			}

		} else {

			pr_err("Fatal invalid tx level %d", tx_level);

			goto err;

		}

		spin_lock_irqsave(&cpp_dev->tasklet_lock, flags);

		queue_cmd = &cpp_dev->tasklet_queue_cmd[cpp_dev->taskletq_idx];

		if (queue_cmd->cmd_used) {
@@ -890,6 +895,7 @@ static irqreturn_t msm_cpp_irq(int irq_num, void *data) 
		pr_debug("DEBUG_R1: 0x%x\n",

			msm_camera_io_r(cpp_dev->base + 0x8C));

	}

err:

	msm_camera_io_w(irq_status, cpp_dev->base + MSM_CPP_MICRO_IRQGEN_CLR);

	return IRQ_HANDLED;

}