A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: vidc: avoid OOB write while accessing memory

Browse source 
Exclude 4 bytes which holds the size of the buffer while calculating
the actual buffer size to avoid OOB write.

Change-Id: I965e78097a3680065aaf7609d35af1a42fc44824
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
This commit is contained in:
Govindaraj Rajagopal 2019-12-13 18:58:22 +05:30 • committed by Gerrit - the friendly Code Review server
commit 05126a1245
1 changed files with 9 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

22
msm/vidc/hfi_common.c
View file

@ -2511,20 +2511,19 @@ skip_power_off:
return -EAGAIN;
}
static void __process_sys_error(struct venus_hfi_device *device)
static void print_sfr_message(struct venus_hfi_device *device)
{
struct hfi_sfr_struct *vsfr = NULL;
u32 vsfr_size = 0;
void *p = NULL;
vsfr = (struct hfi_sfr_struct *)device->sfr.align_virtual_addr;
if (vsfr) {
void *p = memchr(vsfr->rg_data, '\0', vsfr->bufSize);
/*
* SFR isn't guaranteed to be NULL terminated
* since SYS_ERROR indicates that Venus is in the
* process of crashing.
*/
vsfr_size = vsfr->bufSize - sizeof(u32);
p = memchr(vsfr->rg_data, '\0', vsfr_size);
/* SFR isn't guaranteed to be NULL terminated */
if (p == NULL)
vsfr->rg_data[vsfr->bufSize - 1] = '\0';
vsfr->rg_data[vsfr_size - 1] = '\0';
d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data);
}
@ -2661,8 +2660,6 @@ static int __response_handler(struct venus_hfi_device *device)
}
if (call_venus_op(device, watchdog, device->intr_status)) {
struct hfi_sfr_struct *vsfr = (struct hfi_sfr_struct *)
device->sfr.align_virtual_addr;
struct msm_vidc_cb_info info = {
.response_type = HAL_SYS_WATCHDOG_TIMEOUT,
.response.cmd = {
@ -2670,8 +2667,7 @@ static int __response_handler(struct venus_hfi_device *device)
}
};
if (vsfr)
d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data);
print_sfr_message(device);
d_vpr_e("Received watchdog timeout\n");
packets[packet_count++] = info;
@ -2695,7 +2691,7 @@ static int __response_handler(struct venus_hfi_device *device)
/* Process the packet types that we're interested in */
switch (info->response_type) {
case HAL_SYS_ERROR:
__process_sys_error(device);
print_sfr_message(device);
break;
case HAL_SYS_RELEASE_RESOURCE_DONE:
d_vpr_h("Received SYS_RELEASE_RESOURCE\n");