瀏覽代碼

msm: camera: common: Fix integer overflow in shift

Various drivers are using right shift  by 32 to check if dma address is
32 bit addressable. This will result in shift count overflow in 32 bit
arch.

CRs-Fixed: 2543730
Change-Id: I57e30bc9c0a8179c8d74f3bd3b6567bdfff60741
Signed-off-by: Trishansh Bhardwaj <[email protected]>
Trishansh Bhardwaj 5 年之前
父節點
當前提交
30b9eed071

+ 1 - 1
drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c

@@ -4490,7 +4490,7 @@ static void cam_icp_mgr_print_io_bufs(struct cam_packet *packet,
 					"get src buf address fail rc %d", rc);
 				continue;
 			}
-			if (iova_addr >> 32) {
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
 				CAM_ERR(CAM_ICP, "Invalid mapped address");
 				rc = -EINVAL;
 				continue;

+ 1 - 1
drivers/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c

@@ -5740,7 +5740,7 @@ static void cam_ife_mgr_print_io_bufs(struct cam_packet *packet,
 					io_cfg[i].mem_handle[j]);
 				continue;
 			}
-			if (iova_addr >> 32) {
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
 				CAM_ERR(CAM_ISP, "Invalid mapped address");
 				rc = -EINVAL;
 				continue;

+ 1 - 1
drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c

@@ -656,7 +656,7 @@ static void cam_jpeg_mgr_print_io_bufs(struct cam_packet *packet,
 				CAM_ERR(CAM_UTIL, "get src buf address fail");
 				continue;
 			}
-			if (iova_addr >> 32) {
+			if ((iova_addr & 0xFFFFFFFF) != iova_addr) {
 				CAM_ERR(CAM_JPEG, "Invalid mapped address");
 				rc = -EINVAL;
 				continue;