msm: camera: ope: add validation check for axi_path array

Add a range check to avoid array OOB issue while accessing the axi_path array variable. Remove wrong print in CDM. Change-Id: I0552490fcc8d7311cb2491b5db03d441e545691c Signed-off-by: Nirmal Abraham <[email protected]>
MiCode · Aug 26, 2022 · 7d19958 · 7d19958
1 parent 76eae78
commit 7d19958
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 10 deletions.
diff --git a/drivers/cam_cdm/cam_cdm_hw_core.c b/drivers/cam_cdm/cam_cdm_hw_core.c
@@ -1361,8 +1361,6 @@ static void cam_hw_cdm_work(struct work_struct *work)
 				CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK))
 			clear_bit(CAM_CDM_ERROR_HW_STATUS,
 				&core->cdm_status);
-	} else {
-		CAM_ERR(CAM_CDM, "NULL payload");
 	}
 	kfree(payload);
 	payload = NULL;

diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c
@@ -752,8 +752,8 @@ static int32_t cam_ope_process_request_timer(void *priv, void *data)
 			.path_data_type -
 			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
 
-		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
-			CAM_WARN(CAM_OPE,
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
 				"Invalid path %d, start offset=%d, max=%d",
 				ctx_data->clk_info.axi_path[i]
 				.path_data_type,
@@ -1435,8 +1435,8 @@ static bool cam_ope_update_bw_v2(struct cam_ope_hw_mgr *hw_mgr,
 		ctx_data->clk_info.axi_path[i].path_data_type -
 		CAM_AXI_PATH_DATA_OPE_START_OFFSET;
 
-		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
-			CAM_WARN(CAM_OPE,
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
 				"Invalid path %d, start offset=%d, max=%d",
 				ctx_data->clk_info.axi_path[i].path_data_type,
 				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
@@ -1472,8 +1472,8 @@ static bool cam_ope_update_bw_v2(struct cam_ope_hw_mgr *hw_mgr,
 		ctx_data->clk_info.axi_path[i].path_data_type -
 			CAM_AXI_PATH_DATA_OPE_START_OFFSET;
 
-		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
-			CAM_WARN(CAM_OPE,
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
 				"Invalid path %d, start offset=%d, max=%d",
 				ctx_data->clk_info.axi_path[i].path_data_type,
 				CAM_AXI_PATH_DATA_OPE_START_OFFSET,
@@ -2842,8 +2842,8 @@ static int cam_ope_mgr_remove_bw(struct cam_ope_hw_mgr *hw_mgr, int ctx_id)
 		ctx_data->clk_info.axi_path[i].path_data_type -
 		CAM_AXI_PATH_DATA_OPE_START_OFFSET;
 
-		if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) {
-			CAM_WARN(CAM_OPE,
+		if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) {
+			CAM_WARN_RATE_LIMIT(CAM_OPE,
 				"Invalid path %d, start offset=%d, max=%d",
 				ctx_data->clk_info.axi_path[i].path_data_type,
 				CAM_AXI_PATH_DATA_OPE_START_OFFSET,