evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: add check to ensure user task wont hog CPU

Browse source 
If userspace provides a circular list to isp kenrel
driver through an ioctl, then dirver loops forever.
This way the task might hog the CPU in while loop.
To fix this issue, added a preset count to break
the loop after 100 iterations.

CRs-Fixed: 1064608
Change-Id: Ie896fd3da326e5e972266d8004baecf8681aea6d
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
Signed-off-by: Lokesh Kumar Aakulu <lkumar@codeaurora.org>
This commit is contained in:
VijayaKumar T M 2017-02-08 14:16:58 +05:30 • committed by Gerrit - the friendly Code Review server
parent eee829e625
commit 5e8e6aa40e
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
View file

@ -26,6 +26,7 @@
#define MAX_ISP_V4l2_EVENTS 100 #define MAX_ISP_V4l2_EVENTS 100
#define MAX_ISP_REG_LIST 100
static DEFINE_MUTEX(bandwidth_mgr_mutex); static DEFINE_MUTEX(bandwidth_mgr_mutex);
static struct msm_isp_bandwidth_mgr isp_bandwidth_mgr; static struct msm_isp_bandwidth_mgr isp_bandwidth_mgr;
@ -662,6 +663,7 @@ static int msm_isp_set_dual_HW_master_slave_mode(
static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg)
{ {
int rc = 0; int rc = 0;
uint32_t count = 0;
struct msm_vfe_cfg_cmd_list *proc_cmd = struct msm_vfe_cfg_cmd_list *proc_cmd =
(struct msm_vfe_cfg_cmd_list *)arg; (struct msm_vfe_cfg_cmd_list *)arg;
struct msm_vfe_cfg_cmd_list cmd, cmd_next; struct msm_vfe_cfg_cmd_list cmd, cmd_next;
@ -685,6 +687,12 @@ static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg)
sizeof(struct msm_vfe_cfg_cmd_list)); sizeof(struct msm_vfe_cfg_cmd_list));
break; break;
} }
if (++count >= MAX_ISP_REG_LIST) {
pr_err("%s:%d Error exceeding the max register count:%u\n",
__func__, __LINE__, count);
rc = -EINVAL;
break;
}
if (copy_from_user(&cmd_next, (void __user *)cmd.next, if (copy_from_user(&cmd_next, (void __user *)cmd.next,
sizeof(struct msm_vfe_cfg_cmd_list))) { sizeof(struct msm_vfe_cfg_cmd_list))) {
rc = -EFAULT; rc = -EFAULT;
@ -731,6 +739,7 @@ static void msm_isp_compat_to_proc_cmd(struct msm_vfe_cfg_cmd2 *proc_cmd,
static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg)
{ {
int rc = 0; int rc = 0;
uint32_t count = 0;
struct msm_vfe_cfg_cmd_list_32 *proc_cmd = struct msm_vfe_cfg_cmd_list_32 *proc_cmd =
(struct msm_vfe_cfg_cmd_list_32 *)arg; (struct msm_vfe_cfg_cmd_list_32 *)arg;
struct msm_vfe_cfg_cmd_list_32 cmd, cmd_next; struct msm_vfe_cfg_cmd_list_32 cmd, cmd_next;
@ -755,6 +764,12 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg)
sizeof(struct msm_vfe_cfg_cmd_list)); sizeof(struct msm_vfe_cfg_cmd_list));
break; break;
} }
if (++count >= MAX_ISP_REG_LIST) {
pr_err("%s:%d Error exceeding the max register count:%u\n",
__func__, __LINE__, count);
rc = -EINVAL;
break;
}
if (copy_from_user(&cmd_next, compat_ptr(cmd.next), if (copy_from_user(&cmd_next, compat_ptr(cmd.next),
sizeof(struct msm_vfe_cfg_cmd_list_32))) { sizeof(struct msm_vfe_cfg_cmd_list_32))) {
rc = -EFAULT; rc = -EFAULT;