shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 19:08:57 +09:00
Code Issues Packages Projects Releases Wiki Activity

media: rockchip: isp: fix wnd_num cause array access out of bounds

Browse Source 
Change-Id: I689475aacd5e0a49dee067a03c995aee241bcf5b
Signed-off-by: Cai YiWei <cyw@rock-chips.com>
This commit is contained in:
Cai YiWei
2023-11-24 15:34:17 +08:00
committed by Tao Huang
parent b473fca294
commit d2188d8a06
4 changed files with 78 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/media/platform/rockchip/isp/isp_params_v21.c
View File

@@ -1178,6 +1178,12 @@ isp_rawaebig_config(struct rkisp_isp_params_vdev *params_vdev,
ISP2X_REG_WR_MASK);
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(ae_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(ae_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
value |= ISP2X_RAWAEBIG_WNDNUM_SET(wnd_num_idx);
if (arg->subwin_en[0])
@@ -2291,6 +2297,12 @@ isp_rawhstbig_cfg_sram(struct rkisp_isp_params_vdev *params_vdev,
return;
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
memset(weight15x15, 0, sizeof(weight15x15));
for (i = 0; i < hist_wnd_num[wnd_num_idx]; i++) {
for (j = 0; j < hist_wnd_num[wnd_num_idx]; j++) {
@@ -2338,6 +2350,12 @@ isp_rawhstbig_config(struct rkisp_isp_params_vdev *params_vdev,
}
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
/* avoid to override the old enable value */
hist_ctrl = rkisp_ioread32(params_vdev, addr + ISP_RAWHIST_BIG_CTRL);
hist_ctrl &= ISP2X_RAWHSTBIG_CTRL_EN_MASK;

24
drivers/media/platform/rockchip/isp/isp_params_v2x.c
View File

@@ -461,6 +461,12 @@ isp_sihst_config(struct rkisp_isp_params_vdev *params_vdev,
};
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
for (i = 0; i < ISP2X_SIHIST_WIN_NUM; i++) {
/* avoid to override the old enable value */
hist_ctrl = rkisp_ioread32(params_vdev, ISP_HIST_HIST_CTRL + i * 0x10);
@@ -1758,6 +1764,12 @@ isp_rawaebig_config(struct rkisp_isp_params_vdev *params_vdev,
ISP2X_REG_WR_MASK);
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(ae_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(ae_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
value |= ISP2X_RAWAEBIG_WNDNUM_SET(wnd_num_idx);
if (arg->subwin_en[0])
@@ -2831,6 +2843,12 @@ isp_rawhstbig_cfg_sram(struct rkisp_isp_params_vdev *params_vdev,
return;
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
memset(weight15x15, 0, sizeof(weight15x15));
for (i = 0; i < hist_wnd_num[wnd_num_idx]; i++) {
for (j = 0; j < hist_wnd_num[wnd_num_idx]; j++) {
@@ -2879,6 +2897,12 @@ isp_rawhstbig_config(struct rkisp_isp_params_vdev *params_vdev,
}
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
/* avoid to override the old enable value */
hist_ctrl = rkisp_ioread32(params_vdev, addr + ISP_RAWHIST_BIG_CTRL);
hist_ctrl &= ISP2X_RAWHSTBIG_CTRL_EN_MASK;

18
drivers/media/platform/rockchip/isp/isp_params_v32.c
View File

@@ -1436,6 +1436,12 @@ isp_rawaebig_config(struct rkisp_isp_params_vdev *params_vdev,
value &= ISP3X_RAWAE_BIG_EN;
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(ae_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(ae_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
value |= ISP3X_RAWAE_BIG_WND0_NUM(wnd_num_idx);
if (arg->subwin_en[0])
@@ -2413,6 +2419,12 @@ isp_rawhstbig_cfg_sram(struct rkisp_isp_params_vdev *params_vdev,
return;
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
memset(weight15x15, 0, sizeof(weight15x15));
for (i = 0; i < hist_wnd_num[wnd_num_idx]; i++) {
for (j = 0; j < hist_wnd_num[wnd_num_idx]; j++) {
@@ -2463,6 +2475,12 @@ isp_rawhstbig_config(struct rkisp_isp_params_vdev *params_vdev,
}
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
/* avoid to override the old enable value */
hist_ctrl = isp3_param_read(params_vdev, addr + ISP3X_RAWHIST_BIG_CTRL, id);
hist_ctrl &= ISP3X_RAWHIST_EN;

18
drivers/media/platform/rockchip/isp/isp_params_v3x.c
View File

@@ -1291,6 +1291,12 @@ isp_rawaebig_config(struct rkisp_isp_params_vdev *params_vdev,
value &= ISP3X_RAWAE_BIG_EN;
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(ae_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(ae_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
value |= ISP3X_RAWAE_BIG_WND0_NUM(wnd_num_idx);
if (arg->subwin_en[0])
@@ -2424,6 +2430,12 @@ isp_rawhstbig_cfg_sram(struct rkisp_isp_params_vdev *params_vdev,
return;
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
memset(weight15x15, 0, sizeof(weight15x15));
for (i = 0; i < hist_wnd_num[wnd_num_idx]; i++) {
for (j = 0; j < hist_wnd_num[wnd_num_idx]; j++) {
@@ -2471,6 +2483,12 @@ isp_rawhstbig_config(struct rkisp_isp_params_vdev *params_vdev,
}
wnd_num_idx = arg->wnd_num;
if (wnd_num_idx >= ARRAY_SIZE(hist_wnd_num)) {
wnd_num_idx = ARRAY_SIZE(hist_wnd_num) - 1;
dev_err(params_vdev->dev->dev,
"%s invalid wnd_num:%d, set to %d\n",
__func__, arg->wnd_num, wnd_num_idx);
}
/* avoid to override the old enable value */
hist_ctrl = isp3_param_read(params_vdev, addr + ISP3X_RAWHIST_BIG_CTRL, id);
hist_ctrl &= ISP3X_RAWHIST_EN;