Skip to content

Commit

Permalink
OSRC: G9650ZCU6CSJ2
Browse files Browse the repository at this point in the history
  • Loading branch information
@klabit87
klabit87 committed Nov 12, 2019
1 parent 1df8959 commit 05cc9bc
Show file tree
Hide file tree
Showing 9 changed files with 313 additions and 73 deletions.
40 changes: 22 additions & 18 deletions drivers/char/diag/diag_masks.c
View file
Expand Up @@ -641,7 +641,8 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len,
struct diag_build_mask_req_t *req = NULL;
struct diag_msg_build_mask_t rsp;

if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) {
if (!src_buf || !dest_buf || dest_len <= 0 ||
src_len < sizeof(struct diag_build_mask_req_t)) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n",
__func__, src_buf, src_len, dest_buf, dest_len);
return -EINVAL;
Expand Down Expand Up @@ -702,8 +703,8 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len,
info = diag_md_session_get_pid(pid);

mask_info = (!info) ? &msg_mask : info->msg_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || dest_len <= 0 ||
!mask_info || (src_len < sizeof(struct diag_build_mask_req_t))) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand Down Expand Up @@ -781,8 +782,8 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len,
info = diag_md_session_get_pid(pid);

mask_info = (!info) ? &msg_mask : info->msg_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || dest_len <= 0 || !mask_info ||
(src_len < sizeof(struct diag_msg_build_mask_t))) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand Down Expand Up @@ -867,7 +868,9 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len,
break;
}
mask_size = mask_size * sizeof(uint32_t);
memcpy(mask->ptr + offset, src_buf + header_len, mask_size);
if (mask_size && src_len >= header_len + mask_size)
memcpy(mask->ptr + offset, src_buf + header_len,
mask_size);
mutex_unlock(&mask->lock);
mask_info->status = DIAG_CTRL_MASK_VALID;
break;
Expand Down Expand Up @@ -930,8 +933,8 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len,
info = diag_md_session_get_pid(pid);

mask_info = (!info) ? &msg_mask : info->msg_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || dest_len <= 0 || !mask_info ||
(src_len < sizeof(struct diag_msg_config_rsp_t))) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand Down Expand Up @@ -1054,8 +1057,8 @@ static int diag_cmd_update_event_mask(unsigned char *src_buf, int src_len,
mutex_lock(&driver->md_session_lock);
info = diag_md_session_get_pid(pid);
mask_info = (!info) ? &event_mask : info->event_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || dest_len <= 0 || !mask_info ||
src_len < sizeof(struct diag_event_mask_config_t)) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand All @@ -1078,7 +1081,8 @@ static int diag_cmd_update_event_mask(unsigned char *src_buf, int src_len,
}

mutex_lock(&mask_info->lock);
memcpy(mask_info->ptr, src_buf + header_len, mask_len);
if (src_len >= header_len + mask_len)
memcpy(event_mask.ptr, src_buf + header_len, mask_len);
mask_info->status = DIAG_CTRL_MASK_VALID;
mutex_unlock(&mask_info->lock);
mutex_unlock(&driver->md_session_lock);
Expand Down Expand Up @@ -1127,8 +1131,8 @@ static int diag_cmd_toggle_events(unsigned char *src_buf, int src_len,
mutex_lock(&driver->md_session_lock);
info = diag_md_session_get_pid(pid);
mask_info = (!info) ? &event_mask : info->event_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || src_len <= sizeof(uint8_t) ||
dest_len <= 0 || !mask_info) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand Down Expand Up @@ -1201,8 +1205,8 @@ static int diag_cmd_get_log_mask(unsigned char *src_buf, int src_len,
info = diag_md_session_get_pid(pid);

mask_info = (!info) ? &log_mask : info->log_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || dest_len <= 0 || !mask_info ||
src_len < sizeof(struct diag_log_config_req_t)) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand Down Expand Up @@ -1343,8 +1347,8 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len,
info = diag_md_session_get_pid(pid);

mask_info = (!info) ? &log_mask : info->log_mask;
if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||
!mask_info) {
if (!src_buf || !dest_buf || dest_len <= 0 || !mask_info ||
src_len < sizeof(struct diag_log_config_req_t)) {
pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",
__func__, src_buf, src_len, dest_buf, dest_len,
mask_info);
Expand Down Expand Up @@ -1418,7 +1422,7 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len,
mask->range_tools = mask_size;
}
req->num_items = mask->num_items_tools;
if (mask_size > 0)
if (mask_size > 0 && src_len >= read_len + mask_size)
memcpy(mask->ptr, src_buf + read_len, mask_size);
DIAG_LOG(DIAG_DEBUG_MASKS,
"copying log mask, e %d num %d range %d size %d\n",
Expand Down
15 changes: 11 additions & 4 deletions drivers/char/diag/diagchar_core.c
View file
Expand Up @@ -1155,15 +1155,19 @@ static int diag_process_userspace_remote(int proc, void *buf, int len)
}
#endif

static int mask_request_validate(unsigned char mask_buf[])
static int mask_request_validate(unsigned char mask_buf[], int len)
{
uint8_t packet_id;
uint8_t subsys_id;
uint16_t ss_cmd;

if (len <= 0)
return 0;
packet_id = mask_buf[0];

if (packet_id == DIAG_CMD_DIAG_SUBSYS_DELAY) {
if (len < 2*sizeof(uint8_t) + sizeof(uint16_t))
return 0;
subsys_id = mask_buf[1];
ss_cmd = *(uint16_t *)(mask_buf + 2);
switch (subsys_id) {
Expand All @@ -1179,6 +1183,8 @@ static int mask_request_validate(unsigned char mask_buf[])
return 0;
}
} else if (packet_id == 0x4B) {
if (len < 2*sizeof(uint8_t) + sizeof(uint16_t))
return 0;
subsys_id = mask_buf[1];
ss_cmd = *(uint16_t *)(mask_buf + 2);
/* Packets with SSID which are allowed */
Expand Down Expand Up @@ -3030,7 +3036,8 @@ static int diag_user_process_raw_data(const char __user *buf, int len)
}

/* Check for proc_type */
remote_proc = diag_get_remote(*(int *)user_space_data);
if (len >= sizeof(int))
remote_proc = diag_get_remote(*(int *)user_space_data);
if (remote_proc) {
token_offset = sizeof(int);
if (len <= MIN_SIZ_ALLOW) {
Expand All @@ -3044,7 +3051,7 @@ static int diag_user_process_raw_data(const char __user *buf, int len)
}
if (driver->mask_check) {
if (!mask_request_validate(user_space_data +
token_offset)) {
token_offset, len)) {
pr_alert("diag: mask request Invalid\n");
diagmem_free(driver, user_space_data, mempool);
user_space_data = NULL;
Expand Down Expand Up @@ -3122,7 +3129,7 @@ static int diag_user_process_userspace_data(const char __user *buf, int len)
/* Check masks for On-Device logging */
if (driver->mask_check) {
if (!mask_request_validate(driver->user_space_data_buf +
token_offset)) {
token_offset, len)) {
pr_alert("diag: mask request Invalid\n");
return -EFAULT;
}
Expand Down
4 changes: 2 additions & 2 deletions drivers/input/sec_cmd.c
View file
Expand Up @@ -102,7 +102,7 @@ static ssize_t sec_cmd_store(struct device *dev,
return -EINVAL;
}

if (strlen(buf) >= SEC_CMD_STR_LEN) {
if (strnlen(buf, SEC_CMD_STR_LEN) >= SEC_CMD_STR_LEN) {
pr_err("%s %s: cmd length(strlen(buf)) is over (%d,%s)!!\n",
SECLOG, __func__, (int)strlen(buf), buf);
return -EINVAL;
Expand Down Expand Up @@ -321,7 +321,7 @@ static ssize_t sec_cmd_store(struct device *dev, struct device_attribute *devatt
return -EINVAL;
}

if (strlen(buf) >= SEC_CMD_STR_LEN) {
if (strnlen(buf, SEC_CMD_STR_LEN) >= SEC_CMD_STR_LEN) {
pr_err("%s %s: cmd length(strlen(buf)) is over (%d,%s)!!\n",
SECLOG, __func__, (int)strlen(buf), buf);
return -EINVAL;
Expand Down
8 changes: 5 additions & 3 deletions drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.c
View file
@@ -1,4 +1,4 @@
/* Copyright (c) 2011-2014, 2017-2018, The Linux Foundation.
/* Copyright (c) 2011-2014, 2017-2019, The Linux Foundation.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
Expand Down Expand Up @@ -367,12 +367,13 @@ int msm_cam_clk_enable(struct device *dev, struct msm_cam_clk_info *clk_info,
}
} else {
for (i = num_clk - 1; i >= 0; i--) {
if (clk_ptr[i] != NULL) {
if (!IS_ERR_OR_NULL(clk_ptr[i])) {
CDBG("%s disable %s\n", __func__,
clk_info[i].clk_name);
clk_disable(clk_ptr[i]);
clk_unprepare(clk_ptr[i]);
clk_put(clk_ptr[i]);
clk_ptr[i] = NULL;
}
}
}
Expand All @@ -386,10 +387,11 @@ int msm_cam_clk_enable(struct device *dev, struct msm_cam_clk_info *clk_info,
clk_put(clk_ptr[i]);
cam_clk_get_err:
for (i--; i >= 0; i--) {
if (clk_ptr[i] != NULL) {
if (!IS_ERR_OR_NULL(clk_ptr[i])) {
clk_disable(clk_ptr[i]);
clk_unprepare(clk_ptr[i]);
clk_put(clk_ptr[i]);
clk_ptr[i] = NULL;
}
}
return rc;
Expand Down

0 comments on commit 05cc9bc

Please sign in to comment.