Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 106a3029 authored by Dikshita Agarwal's avatar Dikshita Agarwal Committed by Gerrit - the friendly Code Review server
Browse files

msm: vidc: avoid OOB write while accessing memory 



Exclude 4 bytes which holds the size of the buffer while calculating
the actual buffer size to avoid OOB write.

Change-Id: I5471fabc3652a942797019c5beb06d17a713b079
Signed-off-by: default avatarDikshita Agarwal <dikshita@codeaurora.org>
parent a4fda005

drivers/media/platform/msm/vidc/venus_hfi.c

+10 −13
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -3395,9 +3395,11 @@ exit: 
	return;

}



static void __process_sys_error(struct venus_hfi_device *device)

static void print_sfr_message(struct venus_hfi_device *device)

{

	struct hfi_sfr_struct *vsfr = NULL;

	u32 vsfr_size = 0;

	void *p = NULL;



	/* Once SYS_ERROR received from HW, it is safe to halt the AXI.

	 * With SYS_ERROR, Venus FW may have crashed and HW might be
@@ -3408,12 +3410,11 @@ static void __process_sys_error(struct venus_hfi_device *device) 


	vsfr = (struct hfi_sfr_struct *)device->sfr.align_virtual_addr;

	if (vsfr) {

		void *p = memchr(vsfr->rg_data, '\0', vsfr->bufSize);

		/* SFR isn't guaranteed to be NULL terminated

		   since SYS_ERROR indicates that Venus is in the

		   process of crashing.*/

		vsfr_size = vsfr->bufSize - sizeof(u32);

		p = memchr(vsfr->rg_data, '\0', vsfr_size);

		/* SFR isn't guaranteed to be NULL terminated */

		if (p == NULL)

			vsfr->rg_data[vsfr->bufSize - 1] = '\0';

			vsfr->rg_data[vsfr_size - 1] = '\0';



		dprintk(VIDC_ERR, "SFR Message from FW: %s\n",

				vsfr->rg_data);
@@ -3537,8 +3538,6 @@ static int __response_handler(struct venus_hfi_device *device) 
	}



	if (device->intr_status & VIDC_WRAPPER_INTR_CLEAR_A2HWD_BMSK) {

		struct hfi_sfr_struct *vsfr = (struct hfi_sfr_struct *)

			device->sfr.align_virtual_addr;

		struct msm_vidc_cb_info info = {

			.response_type = HAL_SYS_WATCHDOG_TIMEOUT,

			.response.cmd = {
@@ -3546,9 +3545,7 @@ static int __response_handler(struct venus_hfi_device *device) 
			}

		};



		if (vsfr)

			dprintk(VIDC_ERR, "SFR Message from FW: %s\n",

					vsfr->rg_data);

		print_sfr_message(device);



		dprintk(VIDC_ERR, "Received watchdog timeout\n");

		packets[packet_count++] = info;
@@ -3574,7 +3571,7 @@ static int __response_handler(struct venus_hfi_device *device) 
		/* Process the packet types that we're interested in */

		switch (info->response_type) {

		case HAL_SYS_ERROR:

			__process_sys_error(device);

			print_sfr_message(device);

			break;

		case HAL_SYS_RELEASE_RESOURCE_DONE:

			dprintk(VIDC_DBG, "Received SYS_RELEASE_RESOURCE\n");