DigiGoon/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: sensor: TOCTOU error handling

Browse source 
- Proper Handling in case of invalid pinctrl index
- Removing dead code and unused variables
- Change to dereference s_ctrl only after proper
  NULL Dereference Check.

CRs-Fixed: 3875406
Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da
Signed-off-by: Swami Reddy Reddy <quic_swamired@quicinc.com>
This commit is contained in:
Swami Reddy Reddy 2024-07-24 18:53:36 +05:30 • committed by Michael Bestas
parent 45610a015f
commit 771c29041c
No known key found for this signature in database
GPG key ID: CC95044519BE6669
2 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
techpack/camera/drivers/cam_sensor_module/cam_res_mgr/cam_res_mgr.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/init.h>
@ -379,7 +380,7 @@ static int cam_res_mgr_shared_pinctrl_select_state(
cam_res->pctrl_res[idx].pstatus = PINCTRL_STATUS_SUSPEND;
}
return 0;
return rc;
}
static int cam_res_mgr_add_device(struct device *dev,
@ -577,11 +578,9 @@ static void cam_res_mgr_gpio_free(struct device *dev, uint gpio)
bool need_free = true;
int dev_num = 0;
struct cam_gpio_res *gpio_res = NULL;
bool is_shared_gpio = false;
bool is_shared_pctrl_gpio = false;
int pctrl_idx = -1;
is_shared_gpio = cam_res_mgr_gpio_is_in_shared_gpio(gpio);
is_shared_pctrl_gpio =
cam_res_mgr_gpio_is_in_shared_pctrl_gpio(gpio);
@ -634,8 +633,12 @@ static void cam_res_mgr_gpio_free(struct device *dev, uint gpio)
pctrl_idx =
cam_res_mgr_util_get_idx_from_shared_pctrl_gpio(
gpio);
cam_res_mgr_shared_pinctrl_select_state(
pctrl_idx, false);
if (pctrl_idx >= 0) {
cam_res_mgr_shared_pinctrl_select_state(
pctrl_idx, false);
} else {
CAM_ERR(CAM_RES, "invalid pinctrl idx: %d", pctrl_idx);
}
}
CAM_DBG(CAM_RES, "freeing gpio: %u", gpio);

7
techpack/camera/drivers/cam_sensor_module/cam_sensor/cam_sensor_core.c
View file

@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/module.h>
@ -719,13 +719,14 @@ int32_t cam_sensor_driver_cmd(struct cam_sensor_ctrl_t *s_ctrl,
{
int rc = 0, pkt_opcode = 0;
struct cam_control *cmd = (struct cam_control *)arg;
struct cam_sensor_power_ctrl_t *power_info =
&s_ctrl->sensordata->power_info;
struct cam_sensor_power_ctrl_t *power_info = NULL;
if (!s_ctrl || !arg) {
CAM_ERR(CAM_SENSOR, "s_ctrl is NULL");
return -EINVAL;
}
power_info = &s_ctrl->sensordata->power_info;
if (cmd->op_code != CAM_SENSOR_PROBE_CMD) {
if (cmd->handle_type != CAM_HANDLE_USER_POINTER) {
CAM_ERR(CAM_SENSOR, "Invalid handle type: %d",