diff options
| author | VijayaKumar T M <vtmuni@codeaurora.org> | 2017-02-08 14:16:58 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-01 02:54:44 -0800 |
| commit | 5e8e6aa40e42ee168f13ec524df17a2cbf616cf5 (patch) | |
| tree | b3a0bfa42b8eeb7d148f1e196a4e22c56dfeed32 /drivers | |
| parent | eee829e625416a38a8066524a0f6cac3b0c9d55b (diff) | |
msm: camera: add check to ensure user task wont hog CPU
If userspace provides a circular list to isp kenrel
driver through an ioctl, then dirver loops forever.
This way the task might hog the CPU in while loop.
To fix this issue, added a preset count to break
the loop after 100 iterations.
CRs-Fixed: 1064608
Change-Id: Ie896fd3da326e5e972266d8004baecf8681aea6d
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
Signed-off-by: Lokesh Kumar Aakulu <lkumar@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c index df9691be0c28..0d407aead350 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c @@ -26,6 +26,7 @@ #define MAX_ISP_V4l2_EVENTS 100 +#define MAX_ISP_REG_LIST 100 static DEFINE_MUTEX(bandwidth_mgr_mutex); static struct msm_isp_bandwidth_mgr isp_bandwidth_mgr; @@ -662,6 +663,7 @@ static int msm_isp_set_dual_HW_master_slave_mode( static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) { int rc = 0; + uint32_t count = 0; struct msm_vfe_cfg_cmd_list *proc_cmd = (struct msm_vfe_cfg_cmd_list *)arg; struct msm_vfe_cfg_cmd_list cmd, cmd_next; @@ -685,6 +687,12 @@ static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) sizeof(struct msm_vfe_cfg_cmd_list)); break; } + if (++count >= MAX_ISP_REG_LIST) { + pr_err("%s:%d Error exceeding the max register count:%u\n", + __func__, __LINE__, count); + rc = -EINVAL; + break; + } if (copy_from_user(&cmd_next, (void __user *)cmd.next, sizeof(struct msm_vfe_cfg_cmd_list))) { rc = -EFAULT; @@ -731,6 +739,7 @@ static void msm_isp_compat_to_proc_cmd(struct msm_vfe_cfg_cmd2 *proc_cmd, static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) { int rc = 0; + uint32_t count = 0; struct msm_vfe_cfg_cmd_list_32 *proc_cmd = (struct msm_vfe_cfg_cmd_list_32 *)arg; struct msm_vfe_cfg_cmd_list_32 cmd, cmd_next; @@ -755,6 +764,12 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) sizeof(struct msm_vfe_cfg_cmd_list)); break; } + if (++count >= MAX_ISP_REG_LIST) { + pr_err("%s:%d Error exceeding the max register count:%u\n", + __func__, __LINE__, count); + rc = -EINVAL; + break; + } if (copy_from_user(&cmd_next, compat_ptr(cmd.next), sizeof(struct msm_vfe_cfg_cmd_list_32))) { rc = -EFAULT; |