Merge "msm: camera: sensor: Validate step_boundary" (63667e70) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c

+29 −6

Original line number	Diff line number	Diff line
		@@ -853,7 +853,7 @@ static int32_t msm_actuator_bivcm_init_step_table(
		{
		int16_t code_per_step = 0;
		int16_t cur_code = 0;
		int16_t step_index = 0, region_index = 0;
		uint16_t step_index = 0, region_index = 0;
		uint16_t step_boundary = 0;
		uint32_t max_code_size = 1;
		uint16_t data_size = set_info->actuator_params.data_size;
		@@ -894,6 +894,15 @@ static int32_t msm_actuator_bivcm_init_step_table(
		step_boundary =
		a_ctrl->region_params[region_index].
		step_bound[MOVE_NEAR];
		if (step_boundary >
		set_info->af_tuning_params.total_steps) {
		pr_err("invalid step_boundary = %d, max_val = %d",
		step_boundary,
		set_info->af_tuning_params.total_steps);
		kfree(a_ctrl->step_position_table);
		a_ctrl->step_position_table = NULL;
		return -EINVAL;
		}
		qvalue = a_ctrl->region_params[region_index].qvalue;
		for (; step_index <= step_boundary;
		step_index++) {
		@@ -929,20 +938,25 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl,
		int16_t code_per_step = 0;
		uint32_t qvalue = 0;
		int16_t cur_code = 0;
		int16_t step_index = 0, region_index = 0;
		uint16_t step_index = 0, region_index = 0;
		uint16_t step_boundary = 0;
		uint32_t max_code_size = 1;
		uint16_t data_size = set_info->actuator_params.data_size;
		CDBG("Enter\n");

		/* validate the actuator state */
		if (a_ctrl->actuator_state != ACT_OPS_ACTIVE) {
		pr_err("%s:%d invalid actuator_state %d\n"
		, __func__, __LINE__, a_ctrl->actuator_state);
		return -EINVAL;
		}
		for (; data_size > 0; data_size--)
		max_code_size *= 2;

		a_ctrl->max_code_size = max_code_size;
		if ((a_ctrl->actuator_state == ACT_OPS_ACTIVE) &&
		(a_ctrl->step_position_table != NULL)) {

		/* free the step_position_table to allocate a new one */
		kfree(a_ctrl->step_position_table);
		}
		a_ctrl->step_position_table = NULL;

		if (set_info->af_tuning_params.total_steps
		@@ -971,6 +985,15 @@ static int32_t msm_actuator_init_step_table(struct msm_actuator_ctrl_t *a_ctrl,
		step_boundary =
		a_ctrl->region_params[region_index].
		step_bound[MOVE_NEAR];
		if (step_boundary >
		set_info->af_tuning_params.total_steps) {
		pr_err("invalid step_boundary = %d, max_val = %d",
		step_boundary,
		set_info->af_tuning_params.total_steps);
		kfree(a_ctrl->step_position_table);
		a_ctrl->step_position_table = NULL;
		return -EINVAL;
		}
		for (; step_index <= step_boundary;
		step_index++) {
		if (qvalue > 1 && qvalue <= MAX_QVALUE)