Merge "msm: camera: isp: validate in_port before accessing" (12b49656) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

+22 −3

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -1808,18 +1808,36 @@ static int cam_ife_hw_mgr_acquire_res_root(

		static int cam_ife_mgr_check_and_update_fe(
		struct cam_ife_hw_mgr_ctx *ife_ctx,
		struct cam_isp_acquire_hw_info *acquire_hw_info)
		struct cam_isp_acquire_hw_info *acquire_hw_info,
		uint32_t acquire_info_size)
		{
		int i;
		struct cam_isp_in_port_info *in_port = NULL;
		uint32_t in_port_length = 0;
		uint32_t total_in_port_length = 0;

		if (acquire_hw_info->input_info_offset >=
		acquire_hw_info->input_info_size) {
		CAM_ERR(CAM_ISP,
		"Invalid size offset 0x%x is greater then size 0x%x",
		acquire_hw_info->input_info_offset,
		acquire_hw_info->input_info_size);
		return -EINVAL;
		}

		in_port = (struct cam_isp_in_port_info *)
		((uint8_t *)&acquire_hw_info->data +
		acquire_hw_info->input_info_offset);
		for (i = 0; i < acquire_hw_info->num_inputs; i++) {

		if (((uint8_t *)in_port +
		sizeof(struct cam_isp_in_port_info)) >
		((uint8_t *)acquire_hw_info +
		acquire_info_size)) {
		CAM_ERR(CAM_ISP, "Invalid size");
		return -EINVAL;
		}

		if ((in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) \|\|
		(in_port->num_out_res <= 0)) {
		CAM_ERR(CAM_ISP, "Invalid num output res %u",
		@@ -2079,7 +2097,8 @@ static int cam_ife_mgr_acquire_hw(void hw_mgr_priv, void acquire_hw_args)
		acquire_hw_info =
		(struct cam_isp_acquire_hw_info *)acquire_args->acquire_info;

		rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info);
		rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info,
		acquire_args->acquire_info_size);
		if (rc) {
		CAM_ERR(CAM_ISP, "buffer size is not enough");
		goto free_cdm;