Merge "msm: vidc: add additional check to avoid out of bound access" (28bf999d) · Commits · e / devices / android_kernel_fairphone_FP4

msm/vidc/hfi_common.c

+34 −3

Original line number	Diff line number	Diff line
		@@ -36,6 +36,7 @@
		#define FIRMWARE_SIZE 0X00A00000
		#define REG_ADDR_OFFSET_BITMASK 0x000FFFFF
		#define QDSS_IOVA_START 0x80001000
		#define MIN_PAYLOAD_SIZE 3

		static struct hal_device_data hal_ctxt;

		@@ -3261,22 +3262,50 @@ static void __flush_debug_queue(struct venus_hfi_device device, u8 packet)
		log_level \|= FW_PRINTK;
		}

		#define SKIP_INVALID_PKT(pkt_size, payload_size, pkt_hdr_size) ({ \
		if (pkt_size < pkt_hdr_size \|\| \
		payload_size < MIN_PAYLOAD_SIZE \|\| \
		payload_size > \
		(pkt_size - pkt_hdr_size + sizeof(u8))) { \
		dprintk(VIDC_ERR, \
		"%s: invalid msg size - %d\n", \
		__func__, pkt->msg_size); \
		continue; \
		} \
		})

		while (!__iface_dbgq_read(device, packet)) {
		struct hfi_msg_sys_coverage_packet *pkt =
		(struct hfi_msg_sys_coverage_packet *) packet;
		struct hfi_packet_header *pkt =
		(struct hfi_packet_header *) packet;

		if (pkt->size < sizeof(struct hfi_packet_header)) {
		dprintk(VIDC_ERR, "Invalid pkt size - %s\n",
		__func__);
		continue;
		}

		if (pkt->packet_type == HFI_MSG_SYS_COV) {
		struct hfi_msg_sys_coverage_packet *pkt =
		(struct hfi_msg_sys_coverage_packet *) packet;
		int stm_size = 0;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		stm_size = stm_log_inv_ts(0, 0,
		pkt->rg_msg_data, pkt->msg_size);
		if (stm_size == 0)
		dprintk(VIDC_ERR,
		"In %s, stm_log returned size of 0\n",
		__func__);
		} else {

		} else if (pkt->packet_type == HFI_MSG_SYS_DEBUG) {
		struct hfi_msg_sys_debug_packet *pkt =
		(struct hfi_msg_sys_debug_packet *) packet;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		/*
		* All fw messages starts with new line character. This
		* causes dprintk to print this message in two lines
		@@ -3284,9 +3313,11 @@ static void __flush_debug_queue(struct venus_hfi_device device, u8 packet)
		* from the message fixes this to print it in a single
		* line.
		*/
		pkt->rg_msg_data[pkt->msg_size-1] = '\0';
		dprintk_firmware(log_level, "%s", &pkt->rg_msg_data[1]);
		}
		}
		#undef SKIP_INVALID_PKT

		if (local_packet)
		kfree(packet);

msm/vidc/vidc_hfi_helper.h

+5 −0

Original line number	Diff line number	Diff line
		@@ -839,6 +839,11 @@ struct vidc_hal_session_cmd_pkt {
		u32 session_id;
		};

		struct hfi_packet_header {
		u32 size;
		u32 packet_type;
		};

		struct hfi_cmd_sys_init_packet {
		u32 size;
		u32 packet_type;