samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: common: NULL pointer and array fixes

Browse Source 
Fix NULL pointer checks in cam_mem dma_buf functions.
Fix local array bounds check for cam_vfe_top_set_axi_bw_vote.

CRs-Fixed: 2906570
Change-Id: Ib41223ad56cbb5618d73e8aa6907907dd6f8f4fb
Signed-off-by: Karthik Jayakumar <kjayakum@codeaurora.org>
This commit is contained in:
Karthik Jayakumar
2021-03-22 15:31:28 -07:00
parent 7abc280ea9
commit 67707a7305
3 changed files with 25 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/cam_req_mgr/cam_mem_mgr.c
View File

@@ -604,7 +604,7 @@ static int cam_mem_util_get_dma_buf(size_t len,
if (try_heap) {
*buf = dma_heap_buffer_alloc(try_heap, len, O_RDWR, 0);
if (IS_ERR_OR_NULL(*buf)) {
if (IS_ERR(*buf)) {
CAM_WARN(CAM_MEM,
"Failed in allocating from try heap, heap=%pK, len=%zu, err=%d",
try_heap, len, PTR_ERR(*buf));
@@ -614,7 +614,7 @@ static int cam_mem_util_get_dma_buf(size_t len,
if (*buf == NULL) {
*buf = dma_heap_buffer_alloc(heap, len, O_RDWR, 0);
if (IS_ERR_OR_NULL(*buf)) {
if (IS_ERR(*buf)) {
rc = PTR_ERR(*buf);
CAM_ERR(CAM_MEM,
"Failed in allocating from heap, heap=%pK, len=%zu, err=%d",
@@ -924,6 +924,12 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd)
cam_mem_mgr_print_tbl();
return rc;
}
if (!dmabuf) {
CAM_ERR(CAM_MEM,
"Ion Alloc return NULL dmabuf! fd=%d, len=%d", fd, len);
cam_mem_mgr_print_tbl();
return rc;
}
idx = cam_mem_get_slot();
if (idx < 0) {
@@ -1453,13 +1459,14 @@ int cam_mem_mgr_request_mem(struct cam_mem_mgr_request_desc *inp,
return -EINVAL;
}
rc = cam_mem_util_get_dma_buf(inp->size,
inp->flags,
&buf);
rc = cam_mem_util_get_dma_buf(inp->size, inp->flags, &buf);
if (rc) {
CAM_ERR(CAM_MEM, "ION alloc failed for shared buffer");
goto ion_fail;
} else if (!buf) {
CAM_ERR(CAM_MEM, "ION alloc returned NULL buffer");
goto ion_fail;
} else {
CAM_DBG(CAM_MEM, "Got dma_buf = %pK", buf);
}
@@ -1627,13 +1634,14 @@ int cam_mem_mgr_reserve_memory_region(struct cam_mem_mgr_request_desc *inp,
return -EINVAL;
}
rc = cam_mem_util_get_dma_buf(inp->size,
0,
&buf);
rc = cam_mem_util_get_dma_buf(inp->size, 0, &buf);
if (rc) {
CAM_ERR(CAM_MEM, "ION alloc failed for sec heap buffer");
goto ion_fail;
} else if (!buf) {
CAM_ERR(CAM_MEM, "ION alloc returned NULL buffer");
goto ion_fail;
} else {
CAM_DBG(CAM_MEM, "Got dma_buf = %pK", buf);
}