Merge "msm: ais: Fix crash when ioctl VIDIOC_MSM_SENSOR_INIT_CFG is called" (536362dc) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/ais/msm.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -391,6 +391,9 @@ static void msm_add_sd_in_position(struct msm_sd_subdev *msm_subdev,
		struct msm_sd_subdev *temp_sd;

		list_for_each_entry(temp_sd, sd_list, list) {
		if (temp_sd == msm_subdev) {
		return;
		}
		if (msm_subdev->close_seq < temp_sd->close_seq) {
		list_add_tail(&msm_subdev->list, &temp_sd->list);
		return;

drivers/media/platform/msm/ais/sensor/io/msm_camera_cci_i2c.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -17,13 +17,15 @@
		#undef CDBG
		#define CDBG(fmt, args...) pr_debug(fmt, ##args)
		#define S_I2C_DBG(fmt, args...) pr_debug(fmt, ##args)
		#define MAX_I2C_ADDR_TYPE_SIZE (MSM_CAMERA_I2C_3B_ADDR + 1)
		#define MAX_I2C_DATA_TYPE_SIZE (MSM_CAMERA_I2C_SET_BYTE_WRITE_MASK_DATA + 1)

		int32_t msm_camera_cci_i2c_read(struct msm_camera_i2c_client *client,
		uint32_t addr, uint16_t *data,
		enum msm_camera_i2c_data_type data_type)
		{
		int32_t rc = -EFAULT;
		unsigned char buf[client->addr_type+data_type];
		unsigned char buf[MAX_I2C_ADDR_TYPE_SIZE + MAX_I2C_DATA_TYPE_SIZE];
		struct msm_camera_cci_ctrl cci_ctrl;

		if ((client->addr_type != MSM_CAMERA_I2C_BYTE_ADDR

drivers/media/platform/msm/ais/sensor/msm_sensor_driver.c

+15 −8

Original line number	Diff line number	Diff line
		@@ -105,7 +105,11 @@ static int32_t msm_sensor_driver_create_i2c_v4l_subdev
		s_ctrl->msm_sd.sd.entity.name = s_ctrl->msm_sd.sd.name;
		s_ctrl->sensordata->sensor_info->session_id = session_id;
		s_ctrl->msm_sd.close_seq = MSM_SD_CLOSE_2ND_CATEGORY \| 0x3;
		msm_sd_register(&s_ctrl->msm_sd);
		rc = msm_sd_register(&s_ctrl->msm_sd);
		if (rc < 0) {
		pr_err("failed: msm_sd_register rc %d", rc);
		return rc;
		}
		msm_sensor_v4l2_subdev_fops = v4l2_subdev_fops;
		#ifdef CONFIG_COMPAT
		msm_sensor_v4l2_subdev_fops.compat_ioctl32 =
		@@ -133,7 +137,11 @@ static int32_t msm_sensor_driver_create_v4l_subdev
		s_ctrl->msm_sd.sd.entity.group_id = MSM_CAMERA_SUBDEV_SENSOR;
		s_ctrl->msm_sd.sd.entity.name = s_ctrl->msm_sd.sd.name;
		s_ctrl->msm_sd.close_seq = MSM_SD_CLOSE_2ND_CATEGORY \| 0x3;
		msm_sd_register(&s_ctrl->msm_sd);
		rc = msm_sd_register(&s_ctrl->msm_sd);
		if (rc < 0) {
		pr_err("failed: msm_sd_register rc %d", rc);
		return rc;
		}
		msm_cam_copy_v4l2_subdev_fops(&msm_sensor_v4l2_subdev_fops);
		#ifdef CONFIG_COMPAT
		msm_sensor_v4l2_subdev_fops.compat_ioctl32 =
		@@ -882,12 +890,6 @@ CSID_TG:

		pr_err("%s probe succeeded", slave_info->sensor_name);

		/*
		Set probe succeeded flag to 1 so that no other camera shall
		* probed on this slot
		*/
		s_ctrl->is_probe_succeed = 1;

		/*
		* Update the subdevice id of flash-src based on availability in kernel.
		*/
		@@ -926,6 +928,11 @@ CSID_TG:

		msm_sensor_fill_sensor_info(s_ctrl, probed_info, entity_name);

		/*
		Set probe succeeded flag to 1 so that no other camera shall
		* probed on this slot
		*/
		s_ctrl->is_probe_succeed = 1;
		return rc;

		free_camera_info: