evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: cpp: Check for valid tx level

Browse source 
TX and RX FIFOs of Microcontroller are used to exchange commands
and messages between Micro FW and CPP driver. TX FIFO depth is
16 32-bit words, incase of errors there is a chance of overflow.
To prevent possible out of bound access, TX FIFO depth or
level is checked for MAX depth before accessing the FIFO.

Change-Id: I5adf39b46ff10e358c4a2c03a2de07d44b99cedb
Signed-off-by: Pratap Nirujogi <pratapn@codeaurora.org>
This commit is contained in:
Pratap Nirujogi 2018-08-08 20:43:29 +05:30
parent 9656c6c641
commit a98c0c6552
1 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
View file

@ -958,9 +958,14 @@ static irqreturn_t msm_cpp_irq(int irq_num, void *data)
if (irq_status & 0x8) {
tx_level = msm_camera_io_r(cpp_dev->base +
MSM_CPP_MICRO_FIFO_TX_STAT) >> 2;
for (i = 0; i < tx_level; i++) {
tx_fifo[i] = msm_camera_io_r(cpp_dev->base +
MSM_CPP_MICRO_FIFO_TX_DATA);
if (tx_level < MSM_CPP_TX_FIFO_LEVEL) {
for (i = 0; i < tx_level; i++) {
tx_fifo[i] = msm_camera_io_r(cpp_dev->base +
MSM_CPP_MICRO_FIFO_TX_DATA);
}
} else {
pr_err("Fatal invalid tx level %d", tx_level);
goto err;
}
spin_lock_irqsave(&cpp_dev->tasklet_lock, flags);
queue_cmd = &cpp_dev->tasklet_queue_cmd[cpp_dev->taskletq_idx];
@ -1015,6 +1020,7 @@ static irqreturn_t msm_cpp_irq(int irq_num, void *data)
pr_debug("DEBUG_R1: 0x%x\n",
msm_camera_io_r(cpp_dev->base + 0x8C));
}
err:
msm_camera_io_w(irq_status, cpp_dev->base + MSM_CPP_MICRO_IRQGEN_CLR);
return IRQ_HANDLED;
}