Merge "msm: camera: core : Validate the dev name during the node ioctl handler" (cf8acfa8) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/media/platform/msm/camera/cam_core/cam_context.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -519,7 +519,7 @@ int cam_context_init(struct cam_context *ctx,
		mutex_init(&ctx->sync_mutex);
		spin_lock_init(&ctx->lock);

		ctx->dev_name = dev_name;
		strlcpy(ctx->dev_name, dev_name, CAM_CTX_DEV_NAME_MAX_LENGTH);
		ctx->dev_id = dev_id;
		ctx->ctx_id = ctx_id;
		ctx->last_flush_req = 0;

drivers/media/platform/msm/camera/cam_core/cam_context.h

+5 −2

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0-only */
		/*
		* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*/

		#ifndef _CAM_CONTEXT_H_
		@@ -15,6 +15,9 @@
		/* Forward declarations */
		struct cam_context;

		/* max device name string length*/
		#define CAM_CTX_DEV_NAME_MAX_LENGTH 20

		/* max request number */
		#define CAM_CTX_REQ_MAX 20
		#define CAM_CTX_CFG_MAX 20
		@@ -177,7 +180,7 @@ struct cam_ctx_ops {
		*
		*/
		struct cam_context {
		const char *dev_name;
		char dev_name[CAM_CTX_DEV_NAME_MAX_LENGTH];
		uint64_t dev_id;
		uint32_t ctx_id;
		struct list_head list;

drivers/media/platform/msm/camera/cam_core/cam_node.c

+43 −1

Original line number	Diff line number	Diff line
		@@ -27,7 +27,7 @@ static void cam_node_print_ctx_state(
		spin_lock_bh(&ctx->lock);
		CAM_INFO(CAM_CORE,
		"[%s][%d] : state=%d, refcount=%d, active_req_list=%d, pending_req_list=%d, wait_req_list=%d, free_req_list=%d",
		ctx->dev_name ? ctx->dev_name : "null",
		ctx->dev_name,
		i, ctx->state,
		atomic_read(&(ctx->refcount.refcount.refs)),
		list_empty(&ctx->active_req_list),
		@@ -148,6 +148,12 @@ static int __cam_node_handle_acquire_hw_v1(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_acquire_hw(ctx, acquire);
		if (rc) {
		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
		@@ -226,6 +232,12 @@ static int __cam_node_handle_start_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_start_dev(ctx, start);
		if (rc)
		CAM_ERR(CAM_CORE, "Start failure for node %s", node->name);
		@@ -259,6 +271,12 @@ static int __cam_node_handle_stop_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_stop_dev(ctx, stop);
		if (rc)
		CAM_ERR(CAM_CORE, "Stop failure for node %s", node->name);
		@@ -292,6 +310,12 @@ static int __cam_node_handle_config_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_config_dev(ctx, config);
		if (rc)
		CAM_ERR(CAM_CORE, "Config failure for node %s", node->name);
		@@ -325,6 +349,12 @@ static int __cam_node_handle_flush_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_flush_dev(ctx, flush);
		if (rc)
		CAM_ERR(CAM_CORE, "Flush failure for node %s", node->name);
		@@ -358,6 +388,12 @@ static int __cam_node_handle_release_dev(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		if (ctx->state > CAM_CTX_UNINIT && ctx->state < CAM_CTX_STATE_MAX) {
		rc = cam_context_handle_release_dev(ctx, release);
		if (rc)
		@@ -413,6 +449,12 @@ static int __cam_node_handle_release_hw_v1(struct cam_node *node,
		return -EINVAL;
		}

		if (strcmp(node->name, ctx->dev_name)) {
		CAM_ERR(CAM_CORE, "node name %s dev name:%s not matching",
		node->name, ctx->dev_name);
		return -EINVAL;
		}

		rc = cam_context_handle_release_hw(ctx, release);
		if (rc)
		CAM_ERR(CAM_CORE, "context release failed node %s", node->name);

drivers/media/platform/msm/camera/cam_core/cam_node.h

+2 −3

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0-only */
		/*
		* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*/

		#ifndef _CAM_NODE_H_
		@@ -11,7 +11,6 @@
		#include "cam_hw_mgr_intf.h"
		#include "cam_req_mgr_interface.h"

		#define CAM_NODE_NAME_LENGTH_MAX 256

		#define CAM_NODE_STATE_UNINIT 0
		#define CAM_NODE_STATE_INIT 1
		@@ -31,7 +30,7 @@
		*
		*/
		struct cam_node {
		char name[CAM_NODE_NAME_LENGTH_MAX];
		char name[CAM_CTX_DEV_NAME_MAX_LENGTH];
		uint32_t state;

		/* context pool */

drivers/media/platform/msm/camera/cam_fd/cam_fd_context.c

+2 −2

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		*/

		#include <linux/module.h>
		@@ -10,7 +10,7 @@
		#include "cam_fd_context.h"
		#include "cam_trace.h"

		static const char fd_dev_name[] = "fd";
		static const char fd_dev_name[] = "cam-fd";

		/* Functions in Available state */
		static int __cam_fd_ctx_acquire_dev_in_available(struct cam_context *ctx,