diff options
author | evahuang <evahuang@google.com> | 2022-12-13 18:13:34 +0800 |
---|---|---|
committer | evahuang <evahuang@google.com> | 2022-12-13 18:13:34 +0800 |
commit | 06c926c4eb3746bcd801df1561672df2400a412c (patch) | |
tree | fceca5004459382bcbac8e8ad48133e71b0c94b3 | |
parent | f3702afb3a0a928d4af171e67b8aa1740d4796e0 (diff) | |
parent | 98f081b13f9a05832a4ad1c620b4bb720584ec2b (diff) | |
download | camera-kernel-06c926c4eb3746bcd801df1561672df2400a412c.tar.gz |
Merge branch 'android-msm-pixel-4.19-tm-security' into android-msm-pixel-4.19-tm-qpr1android-13.0.0_r0.57android-msm-redbull-4.19-android13-qpr1
FEB 2023.1
Bug: 256875703
Change-Id: Ifee25b1f73e7f28a24e875cacc8985a6356ba2d0
-rw-r--r-- | drivers/cam_req_mgr/cam_mem_mgr.c | 6 | ||||
-rw-r--r-- | drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c | 10 |
2 files changed, 13 insertions, 3 deletions
diff --git a/drivers/cam_req_mgr/cam_mem_mgr.c b/drivers/cam_req_mgr/cam_mem_mgr.c index 9e056cb..77622e2 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.c +++ b/drivers/cam_req_mgr/cam_mem_mgr.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2016-2020, 2022 The Linux Foundation. All rights reserved. */ #include <linux/module.h> @@ -682,7 +682,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) if (rc) { CAM_ERR(CAM_MEM, "Failed in map_hw_va, len=%llu, flags=0x%x, fd=%d, region=%d, num_hdl=%d, rc=%d", - cmd->len, cmd->flags, fd, region, + len, cmd->flags, fd, region, cmd->num_hdl, rc); goto map_hw_fail; } @@ -708,7 +708,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) tbl.bufq[idx].kmdvaddr = kvaddr; tbl.bufq[idx].vaddr = hw_vaddr; tbl.bufq[idx].dma_buf = dmabuf; - tbl.bufq[idx].len = cmd->len; + tbl.bufq[idx].len = len; tbl.bufq[idx].num_hdl = cmd->num_hdl; memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls, sizeof(int32_t) * cmd->num_hdl); diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index cc619cb..a4b0937 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/module.h> @@ -991,7 +992,16 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl, rc = -EINVAL; goto end; } + + if ((num_map + 1) >= + (MSM_EEPROM_MAX_MEM_MAP_CNT * + MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) { + CAM_ERR(CAM_EEPROM, "OOB error"); + rc = -EINVAL; + goto end; + } /* Configure the following map slave address */ + map[num_map + 1].saddr = i2c_info->slave_addr; rc = cam_eeprom_update_slaveInfo(e_ctrl, cmd_buf); |