Merge "msm: cvp: add additional check to avoid out of bound access" (9d4b29a3) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/media/platform/msm/cvp/cvp_hfi.c

+27 −11

Original line number	Diff line number	Diff line
		@@ -37,6 +37,7 @@
		#define FIRMWARE_SIZE 0X00A00000
		#define REG_ADDR_OFFSET_BITMASK 0x000FFFFF
		#define QDSS_IOVA_START 0x80001000
		#define MIN_PAYLOAD_SIZE 3

		const struct msm_cvp_hfi_defs cvp_hfi_defs[] = {
		{
		@@ -3005,22 +3006,35 @@ static void __flush_debug_queue(struct iris_hfi_device device, u8 packet)
		log_level = CVP_ERR;
		}

		while (!__iface_dbgq_read(device, packet)) {
		struct cvp_hfi_msg_sys_coverage_packet *pkt =
		(struct cvp_hfi_msg_sys_coverage_packet *) packet;
		#define SKIP_INVALID_PKT(pkt_size, payload_size, pkt_hdr_size) ({ \
		if (pkt_size < pkt_hdr_size \|\| \
		payload_size < MIN_PAYLOAD_SIZE \|\| \
		payload_size > \
		(pkt_size - pkt_hdr_size + sizeof(u8))) { \
		dprintk(CVP_ERR, \
		"%s: invalid msg size - %d\n", \
		__func__, pkt->msg_size); \
		continue; \
		} \
		})

		if (pkt->packet_type == HFI_MSG_SYS_COV) {
		int stm_size = 0;
		while (!__iface_dbgq_read(device, packet)) {
		struct cvp_hfi_packet_header *pkt =
		(struct cvp_hfi_packet_header *) packet;

		stm_size = stm_log_inv_ts(0, 0,
		pkt->rg_msg_data, pkt->msg_size);
		if (stm_size == 0)
		dprintk(CVP_ERR,
		"In %s, stm_log returned size of 0\n",
		if (pkt->size < sizeof(struct cvp_hfi_packet_header)) {
		dprintk(CVP_ERR, "Invalid pkt size - %s\n",
		__func__);
		} else {
		continue;
		}

		if (pkt->packet_type == HFI_MSG_SYS_DEBUG) {
		struct cvp_hfi_msg_sys_debug_packet *pkt =
		(struct cvp_hfi_msg_sys_debug_packet *) packet;

		SKIP_INVALID_PKT(pkt->size,
		pkt->msg_size, sizeof(*pkt));

		/*
		* All fw messages starts with new line character. This
		* causes dprintk to print this message in two lines
		@@ -3028,9 +3042,11 @@ static void __flush_debug_queue(struct iris_hfi_device device, u8 packet)
		* from the message fixes this to print it in a single
		* line.
		*/
		pkt->rg_msg_data[pkt->msg_size-1] = '\0';
		dprintk(log_level, "%s", &pkt->rg_msg_data[1]);
		}
		}
		#undef SKIP_INVALID_PKT

		if (local_packet)
		kfree(packet);

drivers/media/platform/msm/cvp/cvp_hfi_helper.h

+1 −5

Original line number	Diff line number	Diff line
		@@ -479,13 +479,9 @@ struct cvp_hfi_msg_sys_debug_packet {
		u8 rg_msg_data[1];
		};

		struct cvp_hfi_msg_sys_coverage_packet {
		struct cvp_hfi_packet_header {
		u32 size;
		u32 packet_type;
		u32 msg_size;
		u32 time_stamp_hi;
		u32 time_stamp_lo;
		u8 rg_msg_data[1];
		};

		struct cvp_hfi_sfr_struct {