Merge "msm: vidc: add additional check to avoid out of bound access" (96f7a2c1) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/media/platform/msm/vidc/venus_hfi.c

+34 −3

Original line number	Diff line number	Diff line
		@@ -40,6 +40,7 @@
		#define FIRMWARE_SIZE 0X00A00000
		#define REG_ADDR_OFFSET_BITMASK 0x000FFFFF
		#define QDSS_IOVA_START 0x80001000
		#define MIN_PAYLOAD_SIZE 3

		static struct hal_device_data hal_ctxt;

		@@ -2971,25 +2972,55 @@ static void __flush_debug_queue(struct venus_hfi_device device, u8 packet)
		log_level = VIDC_ERR;
		}

		#define SKIP_INVALID_PKT(pkt_size, payload_size, pkt_hdr_size) ({ \
		if (pkt_size < pkt_hdr_size \|\| \
		payload_size < MIN_PAYLOAD_SIZE \|\| \
		payload_size > \
		(pkt_size - pkt_hdr_size + sizeof(u8))) { \
		dprintk(VIDC_ERR, \
		"%s: invalid msg size - %d\n", \
		__func__, pkt->msg_size); \
		continue; \
		} \
		})

		while (!__iface_dbgq_read(device, packet)) {
		struct hfi_msg_sys_coverage_packet *pkt =
		(struct hfi_msg_sys_coverage_packet *) packet;
		struct hfi_packet_header *pkt =
		(struct hfi_packet_header *) packet;

		if (pkt->size < sizeof(struct hfi_packet_header)) {
		dprintk(VIDC_ERR, "Invalid pkt size - %s\n",
		__func__);
		continue;
		}

		if (pkt->packet_type == HFI_MSG_SYS_COV) {
		struct hfi_msg_sys_coverage_packet *pkt =
		(struct hfi_msg_sys_coverage_packet *) packet;
		int stm_size = 0;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		stm_size = stm_log_inv_ts(0, 0,
		pkt->rg_msg_data, pkt->msg_size);
		if (stm_size == 0)
		dprintk(VIDC_ERR,
		"In %s, stm_log returned size of 0\n",
		__func__);
		} else {

		} else if (pkt->packet_type == HFI_MSG_SYS_DEBUG) {
		struct hfi_msg_sys_debug_packet *pkt =
		(struct hfi_msg_sys_debug_packet *) packet;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		pkt->rg_msg_data[pkt->msg_size-1] = '\0';
		dprintk(log_level, "%s", pkt->rg_msg_data);
		}
		}
		#undef SKIP_INVALID_PKT

		if (local_packet)
		kfree(packet);

drivers/media/platform/msm/vidc/vidc_hfi_helper.h

+5 −0

Original line number	Diff line number	Diff line
		@@ -902,6 +902,11 @@ struct vidc_hal_session_cmd_pkt {
		u32 session_id;
		};

		struct hfi_packet_header {
		u32 size;
		u32 packet_type;
		};

		struct hfi_cmd_sys_init_packet {
		u32 size;
		u32 packet_type;

drivers/media/platform/msm/vidc_3x/venus_hfi.c

+36 −4

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2016, 2018 The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2016, 2018-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -38,6 +38,7 @@
		#define FIRMWARE_SIZE 0X00A00000
		#define REG_ADDR_OFFSET_BITMASK 0x000FFFFF
		#define QDSS_IOVA_START 0x80001000
		#define MIN_PAYLOAD_SIZE 3

		static struct hal_device_data hal_ctxt;

		@@ -3380,24 +3381,55 @@ static void __flush_debug_queue(struct venus_hfi_device device, u8 packet)
		local_packet = true;
		}

		#define SKIP_INVALID_PKT(pkt_size, payload_size, pkt_hdr_size) ({ \
		if (pkt_size < pkt_hdr_size \|\| \
		payload_size < MIN_PAYLOAD_SIZE \|\| \
		payload_size > \
		(pkt_size - pkt_hdr_size + sizeof(u8))) { \
		dprintk(VIDC_ERR, \
		"%s: invalid msg size - %d\n", \
		__func__, pkt->msg_size); \
		continue; \
		} \
		})

		while (!__iface_dbgq_read(device, packet)) {
		struct hfi_packet_header *pkt =
		(struct hfi_packet_header *) packet;

		if (pkt->size < sizeof(struct hfi_packet_header)) {
		dprintk(VIDC_ERR, "Invalid pkt size - %s\n",
		__func__);
		continue;
		}

		if (pkt->packet_type == HFI_MSG_SYS_COV) {
		struct hfi_msg_sys_coverage_packet *pkt =
		(struct hfi_msg_sys_coverage_packet *) packet;
		if (pkt->packet_type == HFI_MSG_SYS_COV) {
		int stm_size = 0;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		stm_size = stm_log_inv_ts(0, 0,
		pkt->rg_msg_data, pkt->msg_size);
		if (stm_size == 0)
		dprintk(VIDC_ERR,
		"In %s, stm_log returned size of 0\n",
		__func__);
		} else {

		} else if (pkt->packet_type == HFI_MSG_SYS_DEBUG) {
		struct hfi_msg_sys_debug_packet *pkt =
		(struct hfi_msg_sys_debug_packet *) packet;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		pkt->rg_msg_data[pkt->msg_size-1] = '\0';
		dprintk(VIDC_FW, "%s", pkt->rg_msg_data);
		}
		}
		#undef SKIP_INVALID_PKT

		if (local_packet)
		kfree(packet);

drivers/media/platform/msm/vidc_3x/vidc_hfi_helper.h

+6 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -974,6 +974,11 @@ struct vidc_hal_session_cmd_pkt {
		u32 session_id;
		};

		struct hfi_packet_header {
		u32 size;
		u32 packet_type;
		};

		struct hfi_cmd_sys_init_packet {
		u32 size;
		u32 packet_type;