Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f10290c4 authored by Abhilash Kumar's avatar Abhilash Kumar
Browse files

msm: camera: icp: Add check for number of IN/OUT entries 



There is a limit on the number of IN/OUT entries that comes
with the packet that is received by the ICP. Add checks to
validate that the packet is with proper configuration.

Change-Id: If4680a577f05016cc392de4abf70bbefe51cdab0
Signed-off-by: default avatarAbhilash Kumar <krabhi@codeaurora.org>
parent 65532007

drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

+59 −0
Original line number Diff line number Diff line
@@ -3243,6 +3243,60 @@ static int cam_icp_mgr_prepare_frame_process_cmd( 
	return 0;

}



static bool cam_icp_mgr_is_valid_inconfig(struct cam_packet *packet)

{

	int i, num_in_map_entries = 0;

	bool in_config_valid = false;

	struct cam_buf_io_cfg *io_cfg_ptr = NULL;



	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload +

					packet->io_configs_offset/4);



	for (i = 0 ; i < packet->num_io_configs; i++)

		if (io_cfg_ptr[i].direction == CAM_BUF_INPUT)

			num_in_map_entries++;



	if (num_in_map_entries <= CAM_MAX_IN_RES) {

		in_config_valid = true;

	} else {

		CAM_ERR(CAM_ICP, "In config entries(%u) more than allowed(%u)",

				num_in_map_entries, CAM_MAX_IN_RES);

	}



	CAM_DBG(CAM_ICP, "number of in_config info: %u %u %u %u",

			packet->num_io_configs, IPE_IO_IMAGES_MAX,

			num_in_map_entries, CAM_MAX_IN_RES);



	return in_config_valid;

}



static bool cam_icp_mgr_is_valid_outconfig(struct cam_packet *packet)

{

	int i, num_out_map_entries = 0;

	bool out_config_valid = false;

	struct cam_buf_io_cfg *io_cfg_ptr = NULL;



	io_cfg_ptr = (struct cam_buf_io_cfg *) ((uint32_t *) &packet->payload +

					packet->io_configs_offset/4);



	for (i = 0 ; i < packet->num_io_configs; i++)

		if (io_cfg_ptr[i].direction == CAM_BUF_OUTPUT)

			num_out_map_entries++;



	if (num_out_map_entries <= CAM_MAX_OUT_RES) {

		out_config_valid = true;

	} else {

		CAM_ERR(CAM_ICP, "Out config entries(%u) more than allowed(%u)",

				num_out_map_entries, CAM_MAX_OUT_RES);

	}



	CAM_DBG(CAM_ICP, "number of out_config info: %u %u %u %u",

			packet->num_io_configs, IPE_IO_IMAGES_MAX,

			num_out_map_entries, CAM_MAX_OUT_RES);



	return out_config_valid;

}



static int cam_icp_mgr_pkt_validation(struct cam_packet *packet)

{

	if (((packet->header.op_code & 0xff) !=
@@ -3266,6 +3320,11 @@ static int cam_icp_mgr_pkt_validation(struct cam_packet *packet) 
		return -EINVAL;

	}



	if (!cam_icp_mgr_is_valid_inconfig(packet) ||

		!cam_icp_mgr_is_valid_outconfig(packet)) {

		return -EINVAL;

	}



	CAM_DBG(CAM_ICP, "number of cmd/patch info: %u %u %u %u",

			packet->num_cmd_buf,

			packet->num_io_configs, IPE_IO_IMAGES_MAX,