From 4cab684d10decaf0509e2986c14c34f8af81fe28 Mon Sep 17 00:00:00 2001 From: Akash Puliyadi Jegannathan Date: Wed, 29 May 2024 14:33:39 +0530 Subject: [PATCH 1/2] msm: camera: sensor: TOCTOU error handling in eeprom IO config can be modified due to access to shared memory. This change scopes the data locally so as to avoid vulnerability of count being modified by external means while executing due to being in shared memory. CRs-Fixed: 3777635 Change-Id: Ia5dd9138dcf8449e2d800aca9ffed73d9c4ba3ea Signed-off-by: Akash Puliyadi Jegannathan --- .../cam_eeprom/cam_eeprom_core.c | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index b43fe126938ca..14f1f9041e263 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -1088,6 +1088,8 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, { struct cam_buf_io_cfg *io_cfg; uint32_t i = 0; + size_t plane_offset; + int32_t mem_handle; int rc = 0; uintptr_t buf_addr; size_t buf_size; @@ -1097,6 +1099,8 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, io_cfg = (struct cam_buf_io_cfg *) ((uint8_t *) &csl_packet->payload + csl_packet->io_configs_offset); + plane_offset = io_cfg->offsets[0]; + mem_handle = io_cfg->mem_handle[0]; CAM_DBG(CAM_EEPROM, "number of IO configs: %d:", csl_packet->num_io_configs); @@ -1104,21 +1108,21 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, for (i = 0; i < csl_packet->num_io_configs; i++) { CAM_DBG(CAM_EEPROM, "Direction: %d:", io_cfg->direction); if (io_cfg->direction == CAM_BUF_OUTPUT) { - rc = cam_mem_get_cpu_buf(io_cfg->mem_handle[0], + rc = cam_mem_get_cpu_buf(mem_handle, &buf_addr, &buf_size); if (rc) { CAM_ERR(CAM_EEPROM, "Fail in get buffer: %d", rc); return rc; } - if (buf_size <= io_cfg->offsets[0]) { + if (buf_size <= plane_offset) { CAM_ERR(CAM_EEPROM, "Not enough buffer"); - cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); + cam_mem_put_cpu_buf(mem_handle); rc = -EINVAL; return rc; } - remain_len = buf_size - io_cfg->offsets[0]; + remain_len = buf_size - plane_offset; CAM_DBG(CAM_EEPROM, "buf_addr : %pK, buf_size : %zu\n", (void *)buf_addr, buf_size); @@ -1126,16 +1130,16 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, if (!read_buffer) { CAM_ERR(CAM_EEPROM, "invalid buffer to copy data"); - cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); + cam_mem_put_cpu_buf(mem_handle); rc = -EINVAL; return rc; } - read_buffer += io_cfg->offsets[0]; + read_buffer += plane_offset; if (remain_len < e_ctrl->cal_data.num_data) { CAM_ERR(CAM_EEPROM, "failed to copy, Invalid size"); - cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); + cam_mem_put_cpu_buf(mem_handle); rc = -EINVAL; return rc; } @@ -1144,7 +1148,7 @@ static int32_t cam_eeprom_get_cal_data(struct cam_eeprom_ctrl_t *e_ctrl, e_ctrl->cal_data.num_data); memcpy(read_buffer, e_ctrl->cal_data.mapdata, e_ctrl->cal_data.num_data); - cam_mem_put_cpu_buf(io_cfg->mem_handle[0]); + cam_mem_put_cpu_buf(mem_handle); } else { CAM_ERR(CAM_EEPROM, "Invalid direction"); rc = -EINVAL; From cb179fe12771b4426eca2384695c9b09cad4f5a3 Mon Sep 17 00:00:00 2001 From: Akash Puliyadi Jegannathan Date: Thu, 30 May 2024 14:27:14 +0530 Subject: [PATCH 2/2] msm: camera: sensor: TOCTOU error handling in eeprom I2C cmd can be modified due to access to shared memory. This change scopes the data locally so as to avoid vulnerability of count being modified by external means while executing due to being in shared memory. CRs-Fixed: 3777534 Change-Id: I4637f49db67d1bd1d5ca418435e3627b5652f604 Signed-off-by: Akash Puliyadi Jegannathan --- .../cam_eeprom/cam_eeprom_core.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index b43fe126938ca..9ba69987fe696 100644 --- a/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -424,6 +424,7 @@ static int32_t cam_eeprom_parse_memory_map( int32_t rc = 0; int32_t cnt = 0; int32_t processed_size = 0; + int32_t payload_count; uint8_t generic_op_code; struct cam_eeprom_memory_map_t *map = data->map; struct common_header *cmm_hdr = @@ -453,24 +454,25 @@ static int32_t cam_eeprom_parse_memory_map( switch (cmm_hdr->cmd_type) { case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR: i2c_random_wr = (struct cam_cmd_i2c_random_wr *)cmd_buf; + payload_count = i2c_random_wr->header.count; - if (i2c_random_wr->header.count == 0 || - i2c_random_wr->header.count >= MSM_EEPROM_MAX_MEM_MAP_CNT || + if (payload_count == 0 || + payload_count >= MSM_EEPROM_MAX_MEM_MAP_CNT || (size_t)*num_map >= ((MSM_EEPROM_MAX_MEM_MAP_CNT * MSM_EEPROM_MEMORY_MAP_MAX_SIZE) - - i2c_random_wr->header.count)) { + payload_count)) { CAM_ERR(CAM_EEPROM, "OOB Error"); return -EINVAL; } cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_random_wr) + - ((i2c_random_wr->header.count - 1) * + ((payload_count - 1) * sizeof(struct i2c_random_wr_payload)); if (cmd_length_in_bytes > remain_buf_len) { CAM_ERR(CAM_EEPROM, "Not enough buffer remaining"); return -EINVAL; } - for (cnt = 0; cnt < (i2c_random_wr->header.count); + for (cnt = 0; cnt < (payload_count); cnt++) { map[*num_map + cnt].page.addr = i2c_random_wr->random_wr_payload[cnt].reg_addr; @@ -483,7 +485,7 @@ static int32_t cam_eeprom_parse_memory_map( map[*num_map + cnt].page.valid_size = 1; } - *num_map += (i2c_random_wr->header.count - 1); + *num_map += (payload_count - 1); cmd_buf += cmd_length_in_bytes / sizeof(int32_t); processed_size += cmd_length_in_bytes; @@ -491,8 +493,9 @@ static int32_t cam_eeprom_parse_memory_map( case CAMERA_SENSOR_CMD_TYPE_I2C_CONT_RD: i2c_cont_rd = (struct cam_cmd_i2c_continuous_rd *)cmd_buf; cmd_length_in_bytes = sizeof(struct cam_cmd_i2c_continuous_rd); + payload_count = i2c_cont_rd->header.count; - if (i2c_cont_rd->header.count >= U32_MAX - data->num_data) { + if (payload_count >= U32_MAX - data->num_data) { CAM_ERR(CAM_EEPROM, "int overflow on eeprom memory block"); return -EINVAL; @@ -501,7 +504,7 @@ static int32_t cam_eeprom_parse_memory_map( map[*num_map].mem.addr_type = i2c_cont_rd->header.addr_type; map[*num_map].mem.data_type = i2c_cont_rd->header.data_type; map[*num_map].mem.valid_size = - i2c_cont_rd->header.count; + payload_count; cmd_buf += cmd_length_in_bytes / sizeof(int32_t); processed_size += cmd_length_in_bytes;