samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: tfe: Fix NULL ptr dereference

Browse Source 
Fixes NULL ptr deref caused by incorrectly passing res_id in place
of res_type.

CRs-Fixed: 2755471
Change-Id: I55ccb6a5fec6e61f79ed0b2cd9fc0cdc62f65b0e
Signed-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>
This commit is contained in:
Trishansh Bhardwaj
2020-08-15 11:45:39 +05:30
parent f64d8b76f2
commit 3da4eff78a
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/cam_isp/isp_hw_mgr/isp_hw/tfe_hw/cam_tfe_bus.c
View File

@@ -1649,19 +1649,19 @@ static int cam_tfe_bus_rup_bottom_half(
static uint32_t cam_tfe_bus_get_last_consumed_addr( static uint32_t cam_tfe_bus_get_last_consumed_addr(
struct cam_tfe_bus_priv *bus_priv, struct cam_tfe_bus_priv *bus_priv,
uint32_t res_id) uint32_t out_id)
{ {
uint32_t val = 0; uint32_t val = 0;
struct cam_isp_resource_node *rsrc_node = NULL; struct cam_isp_resource_node *rsrc_node = NULL;
struct cam_tfe_bus_tfe_out_data *rsrc_data = NULL; struct cam_tfe_bus_tfe_out_data *rsrc_data = NULL;
struct cam_tfe_bus_wm_resource_data *wm_rsrc_data = NULL; struct cam_tfe_bus_wm_resource_data *wm_rsrc_data = NULL;
if (res_id >= CAM_TFE_BUS_TFE_OUT_MAX) { if (out_id >= CAM_TFE_BUS_TFE_OUT_MAX) {
CAM_ERR(CAM_ISP, "invalid res id:%u", res_id); CAM_ERR(CAM_ISP, "invalid out_id:%u", out_id);
return 0; return 0;
} }
rsrc_node = &bus_priv->tfe_out[res_id]; rsrc_node = &bus_priv->tfe_out[out_id];
rsrc_data = rsrc_node->res_priv; rsrc_data = rsrc_node->res_priv;
wm_rsrc_data = rsrc_data->wm_res[PLANE_Y]->res_priv; wm_rsrc_data = rsrc_data->wm_res[PLANE_Y]->res_priv;
@@ -1705,7 +1705,7 @@ static int cam_tfe_bus_bufdone_bottom_half(
evt_info.reg_val = evt_info.reg_val =
cam_tfe_bus_get_last_consumed_addr( cam_tfe_bus_get_last_consumed_addr(
out_rsrc_data->bus_priv, out_rsrc_data->bus_priv,
evt_info.res_id); out_rsrc_data->out_id);
out_rsrc_data->event_cb(out_rsrc_data->priv, out_rsrc_data->event_cb(out_rsrc_data->priv,
CAM_ISP_HW_EVENT_DONE, CAM_ISP_HW_EVENT_DONE,
(void *)&evt_info); (void *)&evt_info);

1
drivers/cam_utils/cam_soc_util.h
View File

@@ -6,6 +6,7 @@
#ifndef _CAM_SOC_UTIL_H_ #ifndef _CAM_SOC_UTIL_H_
#define _CAM_SOC_UTIL_H_ #define _CAM_SOC_UTIL_H_
#include <linux/types.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/clk.h> #include <linux/clk.h>
#include <linux/interrupt.h> #include <linux/interrupt.h>