evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: sensor: Fix crash when ioctl VIDIOC_MSM_SENSOR_INIT_CFG

Browse source 
the invalid data of sensor_init_cfg_data, is used by
msm_sensor_driver_probe. This cause crash when ioctl
VIDIOC_MSM_SENSOR_INIT_CFG repeatedly and aggressively.

Change-Id: Idffcd3b82b9590dbfdcaf14b80668cc894178f54
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
This commit is contained in:
Haibin Liu 2017-08-09 16:26:41 +08:00 • committed by Gerrit - the friendly Code Review server
parent 47b13c41e7
commit 22c9c625bd
3 changed files with 24 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/media/platform/msm/camera_v2/msm.c
View file

@ -388,6 +388,11 @@ static void msm_add_sd_in_position(struct msm_sd_subdev *msm_subdev,
struct msm_sd_subdev *temp_sd; struct msm_sd_subdev *temp_sd;
list_for_each_entry(temp_sd, sd_list, list) { list_for_each_entry(temp_sd, sd_list, list) {
if (temp_sd == msm_subdev) {
pr_err("%s :Fail to add the same sd %d\n",
__func__, __LINE__);
return;
}
if (msm_subdev->close_seq < temp_sd->close_seq) { if (msm_subdev->close_seq < temp_sd->close_seq) {
list_add_tail(&msm_subdev->list, &temp_sd->list); list_add_tail(&msm_subdev->list, &temp_sd->list);
return; return;

6
drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. /* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -17,13 +17,15 @@
#undef CDBG #undef CDBG
#define CDBG(fmt, args...) pr_debug(fmt, ##args) #define CDBG(fmt, args...) pr_debug(fmt, ##args)
#define S_I2C_DBG(fmt, args...) pr_debug(fmt, ##args) #define S_I2C_DBG(fmt, args...) pr_debug(fmt, ##args)
#define MAX_I2C_ADDR_TYPE_SIZE (MSM_CAMERA_I2C_3B_ADDR + 1)
#define MAX_I2C_DATA_TYPE_SIZE (MSM_CAMERA_I2C_SET_BYTE_WRITE_MASK_DATA + 1)
int32_t msm_camera_cci_i2c_read(struct msm_camera_i2c_client *client, int32_t msm_camera_cci_i2c_read(struct msm_camera_i2c_client *client,
uint32_t addr, uint16_t *data, uint32_t addr, uint16_t *data,
enum msm_camera_i2c_data_type data_type) enum msm_camera_i2c_data_type data_type)
{ {
int32_t rc = -EFAULT; int32_t rc = -EFAULT;
unsigned char buf[client->addr_type+data_type]; unsigned char buf[MAX_I2C_ADDR_TYPE_SIZE + MAX_I2C_DATA_TYPE_SIZE];
struct msm_camera_cci_ctrl cci_ctrl; struct msm_camera_cci_ctrl cci_ctrl;
if ((client->addr_type != MSM_CAMERA_I2C_BYTE_ADDR if ((client->addr_type != MSM_CAMERA_I2C_BYTE_ADDR

23
drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c
View file

@ -108,7 +108,11 @@ static int32_t msm_sensor_driver_create_i2c_v4l_subdev
s_ctrl->msm_sd.sd.entity.name = s_ctrl->msm_sd.sd.name; s_ctrl->msm_sd.sd.entity.name = s_ctrl->msm_sd.sd.name;
s_ctrl->sensordata->sensor_info->session_id = session_id; s_ctrl->sensordata->sensor_info->session_id = session_id;
s_ctrl->msm_sd.close_seq = MSM_SD_CLOSE_2ND_CATEGORY | 0x3; s_ctrl->msm_sd.close_seq = MSM_SD_CLOSE_2ND_CATEGORY | 0x3;
msm_sd_register(&s_ctrl->msm_sd); rc = msm_sd_register(&s_ctrl->msm_sd);
if (rc < 0) {
pr_err("failed: msm_sd_register rc %d", rc);
return rc;
}
msm_sensor_v4l2_subdev_fops = v4l2_subdev_fops; msm_sensor_v4l2_subdev_fops = v4l2_subdev_fops;
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
msm_sensor_v4l2_subdev_fops.compat_ioctl32 = msm_sensor_v4l2_subdev_fops.compat_ioctl32 =
@ -148,7 +152,11 @@ static int32_t msm_sensor_driver_create_v4l_subdev
s_ctrl->msm_sd.sd.entity.group_id = MSM_CAMERA_SUBDEV_SENSOR; s_ctrl->msm_sd.sd.entity.group_id = MSM_CAMERA_SUBDEV_SENSOR;
s_ctrl->msm_sd.sd.entity.name = s_ctrl->msm_sd.sd.name; s_ctrl->msm_sd.sd.entity.name = s_ctrl->msm_sd.sd.name;
s_ctrl->msm_sd.close_seq = MSM_SD_CLOSE_2ND_CATEGORY | 0x3; s_ctrl->msm_sd.close_seq = MSM_SD_CLOSE_2ND_CATEGORY | 0x3;
msm_sd_register(&s_ctrl->msm_sd); rc = msm_sd_register(&s_ctrl->msm_sd);
if (rc < 0) {
pr_err("failed: msm_sd_register rc %d", rc);
return rc;
}
msm_cam_copy_v4l2_subdev_fops(&msm_sensor_v4l2_subdev_fops); msm_cam_copy_v4l2_subdev_fops(&msm_sensor_v4l2_subdev_fops);
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
msm_sensor_v4l2_subdev_fops.compat_ioctl32 = msm_sensor_v4l2_subdev_fops.compat_ioctl32 =
@ -995,12 +1003,6 @@ CSID_TG:
pr_err("%s probe succeeded", slave_info->sensor_name); pr_err("%s probe succeeded", slave_info->sensor_name);
/*
Set probe succeeded flag to 1 so that no other camera shall
* probed on this slot
*/
s_ctrl->is_probe_succeed = 1;
s_ctrl->bypass_video_node_creation = s_ctrl->bypass_video_node_creation =
slave_info->bypass_video_node_creation; slave_info->bypass_video_node_creation;
@ -1048,6 +1050,11 @@ CSID_TG:
msm_sensor_fill_sensor_info(s_ctrl, probed_info, entity_name); msm_sensor_fill_sensor_info(s_ctrl, probed_info, entity_name);
/*
* Set probe succeeded flag to 1 so that no other camera shall
* probed on this slot
*/
s_ctrl->is_probe_succeed = 1;
return rc; return rc;
camera_power_down: camera_power_down: