diff options
| -rw-r--r-- | drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c index df9691be0c28..0d407aead350 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c @@ -26,6 +26,7 @@ #define MAX_ISP_V4l2_EVENTS 100 +#define MAX_ISP_REG_LIST 100 static DEFINE_MUTEX(bandwidth_mgr_mutex); static struct msm_isp_bandwidth_mgr isp_bandwidth_mgr; @@ -662,6 +663,7 @@ static int msm_isp_set_dual_HW_master_slave_mode( static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) { int rc = 0; + uint32_t count = 0; struct msm_vfe_cfg_cmd_list *proc_cmd = (struct msm_vfe_cfg_cmd_list *)arg; struct msm_vfe_cfg_cmd_list cmd, cmd_next; @@ -685,6 +687,12 @@ static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) sizeof(struct msm_vfe_cfg_cmd_list)); break; } + if (++count >= MAX_ISP_REG_LIST) { + pr_err("%s:%d Error exceeding the max register count:%u\n", + __func__, __LINE__, count); + rc = -EINVAL; + break; + } if (copy_from_user(&cmd_next, (void __user *)cmd.next, sizeof(struct msm_vfe_cfg_cmd_list))) { rc = -EFAULT; @@ -731,6 +739,7 @@ static void msm_isp_compat_to_proc_cmd(struct msm_vfe_cfg_cmd2 *proc_cmd, static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) { int rc = 0; + uint32_t count = 0; struct msm_vfe_cfg_cmd_list_32 *proc_cmd = (struct msm_vfe_cfg_cmd_list_32 *)arg; struct msm_vfe_cfg_cmd_list_32 cmd, cmd_next; @@ -755,6 +764,12 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) sizeof(struct msm_vfe_cfg_cmd_list)); break; } + if (++count >= MAX_ISP_REG_LIST) { + pr_err("%s:%d Error exceeding the max register count:%u\n", + __func__, __LINE__, count); + rc = -EINVAL; + break; + } if (copy_from_user(&cmd_next, compat_ptr(cmd.next), sizeof(struct msm_vfe_cfg_cmd_list_32))) { rc = -EFAULT; |