samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Vork 0
Code Kwesties Pull-aanvragen Actions Packages Projecten Publicaties Wiki Activiteit

msm: camera: icp: Check for negative BW path index

Bladeren bron 
Validate per path BW index to ensure it's not negative.
During IDLE time for a given IPE/BPS stream the BW structure is
memset to 0x0 forcing the index and vote to 0. On the next instance
when BW is to removed for the given stream from consolidated
BW value the computed index turns out to be less than zero leading
to an invalid array access. This change validates the index
prior to access.

CRs-Fixed: 2841729
Change-Id: I944f07015538323578b9728053a590686ee20d1a
Signed-off-by: Karthik Anantha Ram <kartanan@codeaurora.org>
This commit is contained in:
Karthik Anantha Ram
2021-04-20 00:27:51 -07:00
bovenliggende f77f1673d3
commit df415f79ad
1 gewijzigde bestanden met toevoegingen van 23 en 21 verwijderingen
Download Patch-bestand Download Diff-bestand Expand all files Collapse all files

44
drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
Bestand weergeven

@@ -437,6 +437,23 @@ done:
return rc;
}
static inline bool cam_icp_validate_bw_path_idx(
int path_idx, uint32_t path_data_type)
{
if (path_idx < 0) {
return true;
} else if (path_idx >= CAM_ICP_MAX_PER_PATH_VOTES) {
CAM_WARN(CAM_PERF,
"Invalid path: %u start offset: %d, max: %d",
path_data_type,
CAM_AXI_PATH_DATA_IPE_START_OFFSET,
CAM_ICP_MAX_PER_PATH_VOTES);
return true;
} else {
return false;
}
}
static int cam_icp_remove_ctx_bw(struct cam_icp_hw_mgr *hw_mgr,
struct cam_icp_hw_ctx_data *ctx_data)
{
@@ -554,14 +571,9 @@ static int cam_icp_remove_ctx_bw(struct cam_icp_hw_mgr *hw_mgr,
CAM_AXI_PATH_DATA_IPE_START_OFFSET;
}
if (path_index >= CAM_ICP_MAX_PER_PATH_VOTES) {
CAM_WARN(CAM_PERF,
"Invalid path %d, start offset=%d, max=%d",
ctx_data->clk_info.axi_path[i].path_data_type,
CAM_AXI_PATH_DATA_IPE_START_OFFSET,
CAM_ICP_MAX_PER_PATH_VOTES);
if (cam_icp_validate_bw_path_idx(path_index,
ctx_data->clk_info.axi_path[i].path_data_type))
continue;
}
clk_info->axi_path[path_index].camnoc_bw -=
ctx_data->clk_info.axi_path[i].camnoc_bw;
@@ -1175,14 +1187,9 @@ static bool cam_icp_update_bw_v2(struct cam_icp_hw_mgr *hw_mgr,
CAM_AXI_PATH_DATA_IPE_START_OFFSET;
}
if (path_index >= CAM_ICP_MAX_PER_PATH_VOTES) {
CAM_WARN(CAM_PERF,
"Invalid path %d, start offset=%d, max=%d",
ctx_data->clk_info.axi_path[i].path_data_type,
CAM_AXI_PATH_DATA_IPE_START_OFFSET,
CAM_ICP_MAX_PER_PATH_VOTES);
if (cam_icp_validate_bw_path_idx(path_index,
ctx_data->clk_info.axi_path[i].path_data_type))
continue;
}
hw_mgr_clk_info->axi_path[path_index].camnoc_bw -=
ctx_data->clk_info.axi_path[i].camnoc_bw;
@@ -1219,14 +1226,9 @@ static bool cam_icp_update_bw_v2(struct cam_icp_hw_mgr *hw_mgr,
CAM_AXI_PATH_DATA_IPE_START_OFFSET;
}
if (path_index >= CAM_ICP_MAX_PER_PATH_VOTES) {
CAM_WARN(CAM_PERF,
"Invalid path %d, start offset=%d, max=%d",
ctx_data->clk_info.axi_path[i].path_data_type,
CAM_AXI_PATH_DATA_IPE_START_OFFSET,
CAM_ICP_MAX_PER_PATH_VOTES);
if (cam_icp_validate_bw_path_idx(path_index,
ctx_data->clk_info.axi_path[i].path_data_type))
continue;
}
hw_mgr_clk_info->axi_path[path_index].path_data_type =
ctx_data->clk_info.axi_path[i].path_data_type;