diff options
| author | E V Ravi <evenka@codeaurora.org> | 2019-06-06 11:06:49 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-06-16 22:36:54 -0700 |
| commit | b3ae1ee177a15bcaa1248ce0c068afb333c65362 (patch) | |
| tree | a91a094493314dd50b73b97d0391963f95e4aae7 | |
| parent | 9b2f1354d69d1f8c0f0e2a35d0ac375791b6d249 (diff) | |
msm: ais: sensor: actuator: fix out of bound read for bivcm region params
Issue:
The region index for bivcm is not validated against the region size.
This cause out-of-bound read on the KASAN kernel.
Fix:
Add restriction that region index smaller than region size.
CRs-Fixed: 2379514
Change-Id: Ib4b98bc165da2d27cdeea15b43ae553335d550f7
Signed-off-by: E V Ravi <evenka@codeaurora.org>
| -rw-r--r-- | drivers/media/platform/msm/ais/sensor/actuator/msm_actuator.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/platform/msm/ais/sensor/actuator/msm_actuator.c b/drivers/media/platform/msm/ais/sensor/actuator/msm_actuator.c index 4a23fe0e9c7e..0ab5684ea816 100644 --- a/drivers/media/platform/msm/ais/sensor/actuator/msm_actuator.c +++ b/drivers/media/platform/msm/ais/sensor/actuator/msm_actuator.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -768,6 +768,9 @@ static int32_t msm_actuator_bivcm_move_focus( a_ctrl->curr_step_pos, dest_step_pos, curr_lens_pos); while (a_ctrl->curr_step_pos != dest_step_pos) { + if (a_ctrl->curr_region_index >= a_ctrl->region_size) { + break; + } step_boundary = a_ctrl->region_params[a_ctrl->curr_region_index]. step_bound[dir]; |