msm: camera: isp: Check the stream handles from user

Before operating on the streams sent by userspace ensure that
the stream handles sent from userspace are correct.

CRs-Fixed: 1064457
Change-Id: I0bde105ac751f9e26572efc387dfd88414e0c22d
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>

2 files changed, 40 insertions, 1 deletions

diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
index 9a53d3b23b7c..537e86cbd879 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
@@ -2881,6 +2881,8 @@ static int msm_isp_start_axi_stream(struct vfe_device *vfe_dev_ioctl,
 	msm_isp_get_timestamp(&timestamp);
 
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
+		if (stream_cfg_cmd->stream_handle[i] == 0)
+			continue;
 		stream_info = msm_isp_get_stream_common_data(vfe_dev_ioctl,
 			HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]));
 		if (SRC_TO_INTF(stream_info->stream_src) < VFE_SRC_MAX)
@@ -3020,6 +3022,8 @@ static int msm_isp_stop_axi_stream(struct vfe_device *vfe_dev_ioctl,
 		return -EINVAL;
 
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
+		if (stream_cfg_cmd->stream_handle[i] == 0)
+			continue;
 		stream_info = msm_isp_get_stream_common_data(vfe_dev_ioctl,
 			HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]));
 
@@ -3046,12 +3050,37 @@ int msm_isp_cfg_axi_stream(struct vfe_device *vfe_dev, void *arg)
 {
 	int rc = 0, ret;
 	struct msm_vfe_axi_stream_cfg_cmd *stream_cfg_cmd = arg;
+	uint32_t stream_idx[MAX_NUM_STREAM];
 	int i;
+	int vfe_idx;
+	struct msm_vfe_axi_stream *stream_info;
+
+	memset(stream_idx, 0, sizeof(stream_idx));
 
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
 		if (HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]) >=
 			VFE_AXI_SRC_MAX)
 			return -EINVAL;
+		stream_info = msm_isp_get_stream_common_data(vfe_dev,
+			HANDLE_TO_IDX(stream_cfg_cmd->stream_handle[i]));
+		vfe_idx = msm_isp_get_vfe_idx_for_stream_user(vfe_dev,
+								stream_info);
+		if (vfe_idx == -ENOTTY || stream_info->stream_handle[vfe_idx] !=
+					stream_cfg_cmd->stream_handle[i]) {
+			pr_err("%s: Invalid stream handle %x vfe_idx %d expected %x\n",
+				__func__, stream_cfg_cmd->stream_handle[i],
+				vfe_idx,
+				(vfe_idx != -ENOTTY) ?
+				stream_info->stream_handle[vfe_idx] : 0);
+			return -EINVAL;
+		}
+		/* check for duplicate stream handle */
+		if (stream_idx[stream_info->stream_src] ==
+			stream_cfg_cmd->stream_handle[i])
+			stream_cfg_cmd->stream_handle[i] = 0;
+		else
+			stream_idx[stream_info->stream_src] =
+				stream_cfg_cmd->stream_handle[i];
 	}
 	if (stream_cfg_cmd->cmd == START_STREAM) {
 		msm_isp_axi_update_cgc_override(vfe_dev, stream_cfg_cmd, 1);
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c
index f851e8c9289e..2355c56fcfde 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c
@@ -960,7 +960,9 @@ static int msm_isp_check_stream_cfg_cmd(struct vfe_device *vfe_dev,
 	struct msm_vfe_stats_stream *stream_info;
 	uint32_t idx;
 	int vfe_idx;
+	uint32_t stats_idx[MSM_ISP_STATS_MAX];
 
+	memset(stats_idx, 0, sizeof(stats_idx));
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
 		idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]);
 
@@ -980,6 +982,11 @@ static int msm_isp_check_stream_cfg_cmd(struct vfe_device *vfe_dev,
 				stream_info->stream_handle[vfe_idx]);
 			return -EINVAL;
 		}
+		/* remove duplicate handles */
+		if (stats_idx[idx] == stream_cfg_cmd->stream_handle[i])
+			stream_cfg_cmd->stream_handle[i] = 0;
+		else
+			stats_idx[idx] = stream_cfg_cmd->stream_handle[i];
 	}
 	return 0;
 }
@@ -1083,6 +1090,8 @@ static int msm_isp_start_stats_stream(struct vfe_device *vfe_dev_ioctl,
 	num_stats_comp_mask =
 		vfe_dev_ioctl->hw_info->stats_hw_info->num_stats_comp_mask;
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
+		if (stream_cfg_cmd->stream_handle[i] == 0)
+			continue;
 		idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]);
 		stream_info = msm_isp_get_stats_stream_common_data(
 						vfe_dev_ioctl, idx);
@@ -1169,7 +1178,8 @@ static int msm_isp_stop_stats_stream(struct vfe_device *vfe_dev,
 		vfe_dev->hw_info->stats_hw_info->num_stats_comp_mask;
 
 	for (i = 0; i < stream_cfg_cmd->num_streams; i++) {
-
+		if (stream_cfg_cmd->stream_handle[i] == 0)
+			continue;
 		idx = STATS_IDX(stream_cfg_cmd->stream_handle[i]);
 
 		stream_info = msm_isp_get_stats_stream_common_data(