diff options
| author | PixelBot AutoMerger <android-nexus-securitybot@system.gserviceaccount.com> | 2022-12-25 18:34:11 -0800 |
|---|---|---|
| committer | SecurityBot <android-nexus-securitybot@system.gserviceaccount.com> | 2022-12-25 18:34:11 -0800 |
| commit | 2577e90e94a0d0f32804e18f966aeeec0149be20 (patch) | |
| tree | fceca5004459382bcbac8e8ad48133e71b0c94b3 | |
| parent | f3702afb3a0a928d4af171e67b8aa1740d4796e0 (diff) | |
| parent | 14a2c0b4f7d0dbd91a7492a0e9264ae7c6a9a563 (diff) | |
| download | camera-kernel-android-msm-redbull-4.19-u-beta3.tar.gz | |
Merge android-msm-pixel-4.19-tm-qpr2 into android-msm-pixel-4.19android-u-qpr1-beta-1_r0.6android-u-preview-2_r0.1android-u-beta-5_r0.6android-u-beta-5.3_r0.6android-u-beta-5.2_r0.2android-u-beta-4_r0.6android-u-beta-3_r0.1android-u-beta-2_r0.1android-u-beta-2.1_r0.1android-u-beta-1_r0.2android-14.0.0_r0.1android-msm-redbull-4.19-u-preview-2android-msm-redbull-4.19-u-beta5.3android-msm-redbull-4.19-u-beta5.2android-msm-redbull-4.19-u-beta5android-msm-redbull-4.19-u-beta4android-msm-redbull-4.19-u-beta3android-msm-redbull-4.19-u-beta2android-msm-redbull-4.19-u-beta1android-msm-redbull-4.19-android14-qpr1-beta
SBMerger: 478053055
Change-Id: I81e02577a14966079ad01eab18112248e3985842
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
| -rw-r--r-- | drivers/cam_req_mgr/cam_mem_mgr.c | 6 | ||||
| -rw-r--r-- | drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c | 10 |
2 files changed, 13 insertions, 3 deletions
diff --git a/drivers/cam_req_mgr/cam_mem_mgr.c b/drivers/cam_req_mgr/cam_mem_mgr.c index 9e056cb..77622e2 100644 --- a/drivers/cam_req_mgr/cam_mem_mgr.c +++ b/drivers/cam_req_mgr/cam_mem_mgr.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2016-2020, 2022 The Linux Foundation. All rights reserved. */ #include <linux/module.h> @@ -682,7 +682,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) if (rc) { CAM_ERR(CAM_MEM, "Failed in map_hw_va, len=%llu, flags=0x%x, fd=%d, region=%d, num_hdl=%d, rc=%d", - cmd->len, cmd->flags, fd, region, + len, cmd->flags, fd, region, cmd->num_hdl, rc); goto map_hw_fail; } @@ -708,7 +708,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) tbl.bufq[idx].kmdvaddr = kvaddr; tbl.bufq[idx].vaddr = hw_vaddr; tbl.bufq[idx].dma_buf = dmabuf; - tbl.bufq[idx].len = cmd->len; + tbl.bufq[idx].len = len; tbl.bufq[idx].num_hdl = cmd->num_hdl; memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls, sizeof(int32_t) * cmd->num_hdl); diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index cc619cb..a4b0937 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/module.h> @@ -991,7 +992,16 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl, rc = -EINVAL; goto end; } + + if ((num_map + 1) >= + (MSM_EEPROM_MAX_MEM_MAP_CNT * + MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) { + CAM_ERR(CAM_EEPROM, "OOB error"); + rc = -EINVAL; + goto end; + } /* Configure the following map slave address */ + map[num_map + 1].saddr = i2c_info->slave_addr; rc = cam_eeprom_update_slaveInfo(e_ctrl, cmd_buf); |