Merge "msm: cvp: Add security check on packet" (4b776e23) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/media/platform/msm/cvp/msm_cvp.c

+13 −3

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
		* Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
		*/

		#include "msm_cvp.h"
		@@ -717,8 +717,7 @@ static int msm_cvp_map_user_persist(struct msm_cvp_inst *inst,
		return 0;

		for (i = 0; i < buf_num; i++) {
		buf_ptr = (struct cvp_buf_desc *)
		&in_pkt->pkt_data[offset];
		buf_ptr = (struct cvp_buf_desc *)&in_pkt->pkt_data[offset];

		offset += sizeof(*new_buf) >> 2;
		new_buf = (struct cvp_buf_type *)buf_ptr;
		@@ -904,6 +903,7 @@ static int msm_cvp_session_process_hfi(
		unsigned int offset, buf_num, signal;
		struct cvp_session_queue *sq;
		struct msm_cvp_inst *s;
		unsigned int max_buf_num;

		if (!inst \|\| !inst->core \|\| !in_pkt) {
		dprintk(CVP_ERR, "%s: invalid params\n", __func__);
		@@ -948,6 +948,16 @@ static int msm_cvp_session_process_hfi(
		buf_num = in_buf_num;
		}

		max_buf_num = sizeof(struct cvp_kmd_hfi_packet)
		/ sizeof(struct cvp_buf_type);

		if (buf_num > max_buf_num)
		return -EINVAL;

		if ((offset + buf_num * sizeof(struct cvp_buf_type)) >
		sizeof(struct cvp_kmd_hfi_packet))
		return -EINVAL;

		if (in_pkt->pkt_data[1] == HFI_CMD_SESSION_CVP_SET_PERSIST_BUFFERS)
		rc = msm_cvp_map_user_persist(inst, in_pkt, offset, buf_num);
		else