Browse Source

msm: camera: Fix usage of invalid array index

Fix array index validation number of axi ports while
setup/cleanup axi related settings. Also validate the
array index for slot index for CRM and updates operation
accordingly.

Change-Id: Ic42939b7c59a5602b82a19f558030552bf3c0b72
Signed-off-by: Jigarkumar Zala <[email protected]>
Jigarkumar Zala 6 years ago
parent
commit
4767766efb
2 changed files with 13 additions and 0 deletions
  1. 12 0
      drivers/cam_cpas/cam_cpas_hw.c
  2. 1 0
      drivers/cam_req_mgr/cam_req_mgr_core.c

+ 12 - 0
drivers/cam_cpas/cam_cpas_hw.c

@@ -236,6 +236,12 @@ static int cam_cpas_util_axi_cleanup(struct cam_cpas *cpas_core,
 {
 {
 	int i = 0;
 	int i = 0;
 
 
+	if (cpas_core->num_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_axi_ports: %d",
+			cpas_core->num_axi_ports);
+		return -EINVAL;
+	}
+
 	for (i = 0; i < cpas_core->num_axi_ports; i++) {
 	for (i = 0; i < cpas_core->num_axi_ports; i++) {
 		cam_cpas_util_unregister_bus_client(
 		cam_cpas_util_unregister_bus_client(
 			&cpas_core->axi_port[i].bus_client);
 			&cpas_core->axi_port[i].bus_client);
@@ -252,6 +258,12 @@ static int cam_cpas_util_axi_setup(struct cam_cpas *cpas_core,
 	int i = 0, rc = 0;
 	int i = 0, rc = 0;
 	struct device_node *axi_port_mnoc_node = NULL;
 	struct device_node *axi_port_mnoc_node = NULL;
 
 
+	if (cpas_core->num_axi_ports > CAM_CPAS_MAX_AXI_PORTS) {
+		CAM_ERR(CAM_CPAS, "Invalid num_axi_ports: %d",
+			cpas_core->num_axi_ports);
+		return -EINVAL;
+	}
+
 	for (i = 0; i < cpas_core->num_axi_ports; i++) {
 	for (i = 0; i < cpas_core->num_axi_ports; i++) {
 		axi_port_mnoc_node = cpas_core->axi_port[i].axi_port_node;
 		axi_port_mnoc_node = cpas_core->axi_port[i].axi_port_node;
 		rc = cam_cpas_util_register_bus_client(soc_info,
 		rc = cam_cpas_util_register_bus_client(soc_info,

+ 1 - 0
drivers/cam_req_mgr/cam_req_mgr_core.c

@@ -979,6 +979,7 @@ static int __cam_req_mgr_check_sync_req_is_ready(
 		CAM_DBG(CAM_CRM, "Req: %lld not found on link: %x [other link]",
 		CAM_DBG(CAM_CRM, "Req: %lld not found on link: %x [other link]",
 			req_id, sync_link->link_hdl);
 			req_id, sync_link->link_hdl);
 		sync_ready = false;
 		sync_ready = false;
+		return -EAGAIN;
 	}
 	}
 
 
 	sync_rd_idx = sync_link->req.in_q->rd_idx;
 	sync_rd_idx = sync_link->req.in_q->rd_idx;