Merge "msm: vidc: avoid OOB write while accessing memory" (3b43b29e) · Commits · e / devices / android_kernel_fairphone_FP4

msm/vidc/hfi_common.c

+9 −13

Original line number	Diff line number	Diff line
		@@ -3069,20 +3069,19 @@ static int __power_collapse(struct venus_hfi_device *device, bool force)
		return -EAGAIN;
		}

		static void __process_sys_error(struct venus_hfi_device *device)
		static void print_sfr_message(struct venus_hfi_device *device)
		{
		struct hfi_sfr_struct *vsfr = NULL;
		u32 vsfr_size = 0;
		void *p = NULL;

		vsfr = (struct hfi_sfr_struct *)device->sfr.align_virtual_addr;
		if (vsfr) {
		void *p = memchr(vsfr->rg_data, '\0', vsfr->bufSize);
		/*
		* SFR isn't guaranteed to be NULL terminated
		* since SYS_ERROR indicates that Venus is in the
		* process of crashing.
		*/
		vsfr_size = vsfr->bufSize - sizeof(u32);
		p = memchr(vsfr->rg_data, '\0', vsfr_size);
		/* SFR isn't guaranteed to be NULL terminated */
		if (p == NULL)
		vsfr->rg_data[vsfr->bufSize - 1] = '\0';
		vsfr->rg_data[vsfr_size - 1] = '\0';

		d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data);
		}
		@@ -3233,8 +3232,6 @@ static int __response_handler(struct venus_hfi_device *device)
		}

		if (call_venus_op(device, watchdog, device->intr_status)) {
		struct hfi_sfr_struct vsfr = (struct hfi_sfr_struct )
		device->sfr.align_virtual_addr;
		struct msm_vidc_cb_info info = {
		.response_type = HAL_SYS_WATCHDOG_TIMEOUT,
		.response.cmd = {
		@@ -3242,8 +3239,7 @@ static int __response_handler(struct venus_hfi_device *device)
		}
		};

		if (vsfr)
		d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data);
		print_sfr_message(device);

		d_vpr_e("Received watchdog timeout\n");
		packets[packet_count++] = info;
		@@ -3267,7 +3263,7 @@ static int __response_handler(struct venus_hfi_device *device)
		/* Process the packet types that we're interested in */
		switch (info->response_type) {
		case HAL_SYS_ERROR:
		__process_sys_error(device);
		print_sfr_message(device);
		break;
		case HAL_SYS_RELEASE_RESOURCE_DONE:
		d_vpr_h("Received SYS_RELEASE_RESOURCE\n");