msm: camera: isp: fix KMD prevent issues like OOB
Integer pointer passed as a parameter to function cam_irq_controller_register_dependent is used as an array iterating over num_registers. This might corrupt or misinterpret adjacent memory locations causing out of bound access issues. This change fixes this issue by passing an array of size num_registers as a parameter to cam_irq_controller_register_dependent. Also, initializes struct dma_buf_map to 0. CRs-Fixed: 3658797 Change-Id: I18260c9be4df77716f00c3f5980aeb506e35dcdc Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
此提交包含在:
@@ -558,7 +558,7 @@ static int inline cam_subdev_list_cmp(struct cam_subdev *entry_1, struct cam_sub
|
||||
#if (KERNEL_VERSION(5, 18, 0) <= LINUX_VERSION_CODE)
|
||||
int cam_compat_util_get_dmabuf_va(struct dma_buf *dmabuf, uintptr_t *vaddr)
|
||||
{
|
||||
struct iosys_map mapping;
|
||||
struct iosys_map mapping = {0};
|
||||
int error_code = dma_buf_vmap(dmabuf, &mapping);
|
||||
|
||||
if (error_code) {
|
||||
|
新增問題並參考
封鎖使用者