msm: camera: isp: fix KMD prevent issues like OOB

Integer pointer passed as a parameter to function
cam_irq_controller_register_dependent is used as an
array iterating over num_registers. This might corrupt
or misinterpret adjacent memory locations causing out
of bound access issues.

This change fixes this issue by passing an array of
size num_registers as a parameter to
cam_irq_controller_register_dependent. Also, initializes
struct dma_buf_map to 0.

CRs-Fixed: 3658797
Change-Id: I18260c9be4df77716f00c3f5980aeb506e35dcdc
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
此提交包含在:
Shivakumar Malke
2023-11-24 18:04:39 +05:30
父節點 7bc34c139c
當前提交 9a45cdd009
共有 2 個檔案被更改,包括 48 行新增17 行删除

查看文件

@@ -558,7 +558,7 @@ static int inline cam_subdev_list_cmp(struct cam_subdev *entry_1, struct cam_sub
#if (KERNEL_VERSION(5, 18, 0) <= LINUX_VERSION_CODE)
int cam_compat_util_get_dmabuf_va(struct dma_buf *dmabuf, uintptr_t *vaddr)
{
struct iosys_map mapping;
struct iosys_map mapping = {0};
int error_code = dma_buf_vmap(dmabuf, &mapping);
if (error_code) {