Skip to content
Snippets Groups Projects
Commit e222362e authored by Sreesudhan Ramakrish Ramkumar's avatar Sreesudhan Ramakrish Ramkumar Committed by Thierry Strudel
Browse files

msm: camera: isp: Validate input parameters in ioctl handler


Validate reg_offset, data_offset, hi_tbl_offset, lo_tbl_offset
and len parameters before consuming to avoid invalid register access
and invalid memory access.

Bug: 28804030
Change-Id: Ib0c1fd2b640576cadfc50fbb6485be6160a51deb
Signed-off-by: default avatarSreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>
parent 225110e5
No related branches found
No related tags found
No related merge requests found
......@@ -500,28 +500,42 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev,
cmd_len);
return -EINVAL;
}
/* Validate input parameters */
switch (reg_cfg_cmd->cmd_type) {
case VFE_WRITE: {
if (reg_cfg_cmd->u.rw_info.reg_offset <
resource_size(vfe_dev->vfe_mem)) {
uint32_t diff = 0;
diff = resource_size(vfe_dev->vfe_mem) -
reg_cfg_cmd->u.rw_info.reg_offset;
if (diff < reg_cfg_cmd->u.rw_info.len) {
pr_err("%s: VFE_WRITE: Invalid length\n",
__func__);
case VFE_WRITE:
case VFE_READ: {
if ((reg_cfg_cmd->u.rw_info.reg_offset >
(UINT_MAX - reg_cfg_cmd->u.rw_info.len)) ||
((reg_cfg_cmd->u.rw_info.reg_offset +
reg_cfg_cmd->u.rw_info.len) >
resource_size(vfe_dev->vfe_mem))) {
pr_err("%s:%d reg_offset %d len %d res %d\n",
__func__, __LINE__,
reg_cfg_cmd->u.rw_info.reg_offset,
reg_cfg_cmd->u.rw_info.len,
(uint32_t)resource_size(vfe_dev->vfe_mem));
return -EINVAL;
}
} else {
pr_err("%s: VFE_WRITE: Invalid length\n", __func__);
if ((reg_cfg_cmd->u.rw_info.cmd_data_offset >
(UINT_MAX - reg_cfg_cmd->u.rw_info.len)) ||
((reg_cfg_cmd->u.rw_info.cmd_data_offset +
reg_cfg_cmd->u.rw_info.len) > cmd_len)) {
pr_err("%s:%d cmd_data_offset %d len %d cmd_len %d\n",
__func__, __LINE__,
reg_cfg_cmd->u.rw_info.cmd_data_offset,
reg_cfg_cmd->u.rw_info.len, cmd_len);
return -EINVAL;
}
if (resource_size(vfe_dev->vfe_mem) <
(reg_cfg_cmd->u.rw_info.reg_offset +
reg_cfg_cmd->u.rw_info.len)) {
pr_err("%s: VFE_WRITE: Invalid length\n", __func__);
return -EINVAL;
break;
}
default:
break;
}
switch (reg_cfg_cmd->cmd_type) {
case VFE_WRITE: {
msm_camera_io_memcpy(vfe_dev->vfe_base +
reg_cfg_cmd->u.rw_info.reg_offset,
cfg_data + reg_cfg_cmd->u.rw_info.cmd_data_offset/4,
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment