samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: isp: Modify check to avoid NULL dereference

Browse Source 
Modify cdm ops check in IFE/SFE bus to avoid NULL pointer dereference.

CRs-Fixed: 2841729
Change-Id: I45a23d3069a8edc49ed6df4abb7187e81a71717b
Signed-off-by: Karthik Anantha Ram <kartanan@codeaurora.org>
This commit is contained in:
Karthik Anantha Ram
2021-06-15 11:32:09 -07:00
committed by Gerrit - the friendly Code Review server
parent a5acc9cc9f
commit 0999770372
3 changed files with 25 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_rd.c
View File

@@ -1153,8 +1153,8 @@ static int cam_sfe_bus_rd_config_rm(void *priv, void *cmd_args,
sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *) sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
update_buf->res->res_priv; update_buf->res->res_priv;
if (!sfe_bus_rd_data || !sfe_bus_rd_data->cdm_util_ops) { if (!sfe_bus_rd_data) {
CAM_ERR(CAM_SFE, "Failed! Invalid data"); CAM_ERR(CAM_SFE, "Invalid data");
return -EINVAL; return -EINVAL;
} }
@@ -1255,14 +1255,12 @@ static int cam_sfe_bus_rd_update_rm(void *priv, void *cmd_args,
sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *) sfe_bus_rd_data = (struct cam_sfe_bus_rd_data *)
update_buf->res->res_priv; update_buf->res->res_priv;
if (!sfe_bus_rd_data || !sfe_bus_rd_data->cdm_util_ops) {
cdm_util_ops = sfe_bus_rd_data->cdm_util_ops; CAM_ERR(CAM_SFE, "Invalid data");
if (!sfe_bus_rd_data || !cdm_util_ops) {
CAM_ERR(CAM_SFE, "Failed! Invalid data");
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = sfe_bus_rd_data->cdm_util_ops;
CAM_DBG(CAM_SFE, "#of RM: %d scratch_buf_cfg: %s", CAM_DBG(CAM_SFE, "#of RM: %d scratch_buf_cfg: %s",
sfe_bus_rd_data->num_rm, sfe_bus_rd_data->num_rm,
update_buf->use_scratch_cfg ? "true" : "false"); update_buf->use_scratch_cfg ? "true" : "false");

28
drivers/cam_isp/isp_hw_mgr/isp_hw/sfe_hw/sfe_bus/cam_sfe_bus_wr.c
View File

@@ -2096,14 +2096,12 @@ static int cam_sfe_bus_wr_update_wm(void *priv, void *cmd_args,
sfe_out_data = (struct cam_sfe_bus_wr_out_data *) sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
update_buf->res->res_priv; update_buf->res->res_priv;
if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
cdm_util_ops = sfe_out_data->cdm_util_ops; CAM_ERR(CAM_SFE, "Invalid data");
if (!sfe_out_data || !cdm_util_ops) {
CAM_ERR(CAM_SFE, "Failed! Invalid data");
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = sfe_out_data->cdm_util_ops;
if (update_buf->wm_update->num_buf != sfe_out_data->num_wm) { if (update_buf->wm_update->num_buf != sfe_out_data->num_wm) {
CAM_ERR(CAM_SFE, CAM_ERR(CAM_SFE,
"Failed! Invalid number buffers:%d required:%d", "Failed! Invalid number buffers:%d required:%d",
@@ -2295,8 +2293,8 @@ static int cam_sfe_bus_wr_config_wm(void *priv, void *cmd_args,
sfe_out_data = (struct cam_sfe_bus_wr_out_data *) sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
update_buf->res->res_priv; update_buf->res->res_priv;
if (!sfe_out_data || !sfe_out_data->cdm_util_ops) { if (!sfe_out_data) {
CAM_ERR(CAM_SFE, "Failed! Invalid data"); CAM_ERR(CAM_SFE, "Invalid data");
return -EINVAL; return -EINVAL;
} }
@@ -2426,12 +2424,12 @@ static int cam_sfe_bus_wr_update_hfr(void *priv, void *cmd_args,
sfe_out_data = (struct cam_sfe_bus_wr_out_data *) sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
update_hfr->res->res_priv; update_hfr->res->res_priv;
cdm_util_ops = sfe_out_data->cdm_util_ops; if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
if (!sfe_out_data || !cdm_util_ops) { CAM_ERR(CAM_SFE, "Invalid data");
CAM_ERR(CAM_SFE, "Failed! Invalid data");
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = sfe_out_data->cdm_util_ops;
reg_val_pair = &sfe_out_data->common_data->io_buf_update[0]; reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data; hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
@@ -2648,16 +2646,12 @@ static int cam_sfe_bus_wr_update_bw_limiter(
sfe_out_data = (struct cam_sfe_bus_wr_out_data *) sfe_out_data = (struct cam_sfe_bus_wr_out_data *)
wm_config_update->res->res_priv; wm_config_update->res->res_priv;
if (!sfe_out_data || !sfe_out_data->cdm_util_ops) {
cdm_util_ops = sfe_out_data->cdm_util_ops; CAM_ERR(CAM_SFE, "Invalid data");
if (!sfe_out_data || !cdm_util_ops) {
CAM_ERR(CAM_SFE,
"Failed invalid data out_data: %pK cdm_utils_ops: %pK",
sfe_out_data, cdm_util_ops);
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = sfe_out_data->cdm_util_ops;
reg_val_pair = &sfe_out_data->common_data->io_buf_update[0]; reg_val_pair = &sfe_out_data->common_data->io_buf_update[0];
for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) { for (i = 0, j = 0; i < sfe_out_data->num_wm; i++) {
if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) { if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) {

24
drivers/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
View File

@@ -3002,14 +3002,12 @@ static int cam_vfe_bus_ver3_update_wm(void *priv, void *cmd_args,
vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *) vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
update_buf->res->res_priv; update_buf->res->res_priv;
if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
cdm_util_ops = vfe_out_data->cdm_util_ops; CAM_ERR(CAM_ISP, "Invalid data");
if (!vfe_out_data || !cdm_util_ops) {
CAM_ERR(CAM_ISP, "Failed! Invalid data");
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = vfe_out_data->cdm_util_ops;
if (update_buf->wm_update->num_buf != vfe_out_data->num_wm) { if (update_buf->wm_update->num_buf != vfe_out_data->num_wm) {
CAM_ERR(CAM_ISP, CAM_ERR(CAM_ISP,
"Failed! Invalid number buffers:%d required:%d", "Failed! Invalid number buffers:%d required:%d",
@@ -3226,12 +3224,12 @@ static int cam_vfe_bus_ver3_update_hfr(void *priv, void *cmd_args,
vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *) vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
update_hfr->res->res_priv; update_hfr->res->res_priv;
cdm_util_ops = vfe_out_data->cdm_util_ops; if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
if (!vfe_out_data || !cdm_util_ops) { CAM_ERR(CAM_ISP, "Invalid data");
CAM_ERR(CAM_ISP, "Failed! Invalid data");
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = vfe_out_data->cdm_util_ops;
reg_val_pair = &vfe_out_data->common_data->io_buf_update[0]; reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data; hfr_cfg = (struct cam_isp_port_hfr_config *)update_hfr->data;
@@ -3582,16 +3580,12 @@ static int cam_vfe_bus_update_bw_limiter(
vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *) vfe_out_data = (struct cam_vfe_bus_ver3_vfe_out_data *)
wm_config_update->res->res_priv; wm_config_update->res->res_priv;
if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
cdm_util_ops = vfe_out_data->cdm_util_ops; CAM_ERR(CAM_ISP, "Invalid data");
if (!vfe_out_data || !cdm_util_ops) {
CAM_ERR(CAM_ISP,
"Failed invalid data out_data: %pK cdm_utils_ops: %pK",
vfe_out_data, cdm_util_ops);
return -EINVAL; return -EINVAL;
} }
cdm_util_ops = vfe_out_data->cdm_util_ops;
reg_val_pair = &vfe_out_data->common_data->io_buf_update[0]; reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) { for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) { if (j >= (MAX_REG_VAL_PAIR_SIZE - (MAX_BUF_UPDATE_REG_NUM * 2))) {