From 7d19958a469ced7fe9a0a541b8e265c21022f599 Mon Sep 17 00:00:00 2001 From: Nirmal Abraham Date: Fri, 26 Aug 2022 06:27:46 +0530 Subject: [PATCH] msm: camera: ope: add validation check for axi_path array Add a range check to avoid array OOB issue while accessing the axi_path array variable. Remove wrong print in CDM. Change-Id: I0552490fcc8d7311cb2491b5db03d441e545691c Signed-off-by: Nirmal Abraham --- drivers/cam_cdm/cam_cdm_hw_core.c | 2 -- drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c | 16 ++++++++-------- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/drivers/cam_cdm/cam_cdm_hw_core.c b/drivers/cam_cdm/cam_cdm_hw_core.c index 4d1cccb99..d64af4d09 100644 --- a/drivers/cam_cdm/cam_cdm_hw_core.c +++ b/drivers/cam_cdm/cam_cdm_hw_core.c @@ -1361,8 +1361,6 @@ static void cam_hw_cdm_work(struct work_struct *work) CAM_CDM_IRQ_STATUS_ERROR_INV_CMD_MASK)) clear_bit(CAM_CDM_ERROR_HW_STATUS, &core->cdm_status); - } else { - CAM_ERR(CAM_CDM, "NULL payload"); } kfree(payload); payload = NULL; diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c index 83f2379e7..0731e1b9e 100644 --- a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c +++ b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c @@ -752,8 +752,8 @@ static int32_t cam_ope_process_request_timer(void *priv, void *data) .path_data_type - CAM_AXI_PATH_DATA_OPE_START_OFFSET; - if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) { - CAM_WARN(CAM_OPE, + if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) { + CAM_WARN_RATE_LIMIT(CAM_OPE, "Invalid path %d, start offset=%d, max=%d", ctx_data->clk_info.axi_path[i] .path_data_type, @@ -1435,8 +1435,8 @@ static bool cam_ope_update_bw_v2(struct cam_ope_hw_mgr *hw_mgr, ctx_data->clk_info.axi_path[i].path_data_type - CAM_AXI_PATH_DATA_OPE_START_OFFSET; - if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) { - CAM_WARN(CAM_OPE, + if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) { + CAM_WARN_RATE_LIMIT(CAM_OPE, "Invalid path %d, start offset=%d, max=%d", ctx_data->clk_info.axi_path[i].path_data_type, CAM_AXI_PATH_DATA_OPE_START_OFFSET, @@ -1472,8 +1472,8 @@ static bool cam_ope_update_bw_v2(struct cam_ope_hw_mgr *hw_mgr, ctx_data->clk_info.axi_path[i].path_data_type - CAM_AXI_PATH_DATA_OPE_START_OFFSET; - if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) { - CAM_WARN(CAM_OPE, + if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) { + CAM_WARN_RATE_LIMIT(CAM_OPE, "Invalid path %d, start offset=%d, max=%d", ctx_data->clk_info.axi_path[i].path_data_type, CAM_AXI_PATH_DATA_OPE_START_OFFSET, @@ -2842,8 +2842,8 @@ static int cam_ope_mgr_remove_bw(struct cam_ope_hw_mgr *hw_mgr, int ctx_id) ctx_data->clk_info.axi_path[i].path_data_type - CAM_AXI_PATH_DATA_OPE_START_OFFSET; - if (path_index >= CAM_OPE_MAX_PER_PATH_VOTES) { - CAM_WARN(CAM_OPE, + if ((path_index < 0) || (path_index >= CAM_OPE_MAX_PER_PATH_VOTES)) { + CAM_WARN_RATE_LIMIT(CAM_OPE, "Invalid path %d, start offset=%d, max=%d", ctx_data->clk_info.axi_path[i].path_data_type, CAM_AXI_PATH_DATA_OPE_START_OFFSET,