From 05126a1245c61f2bd98ca61819b2723915fe85ea Mon Sep 17 00:00:00 2001 From: Govindaraj Rajagopal Date: Fri, 13 Dec 2019 18:58:22 +0530 Subject: [PATCH] msm: vidc: avoid OOB write while accessing memory Exclude 4 bytes which holds the size of the buffer while calculating the actual buffer size to avoid OOB write. Change-Id: I965e78097a3680065aaf7609d35af1a42fc44824 Signed-off-by: Govindaraj Rajagopal --- msm/vidc/hfi_common.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/msm/vidc/hfi_common.c b/msm/vidc/hfi_common.c index 28bfbab2498f..523475a9762a 100644 --- a/msm/vidc/hfi_common.c +++ b/msm/vidc/hfi_common.c @@ -2511,20 +2511,19 @@ skip_power_off: return -EAGAIN; } -static void __process_sys_error(struct venus_hfi_device *device) +static void print_sfr_message(struct venus_hfi_device *device) { struct hfi_sfr_struct *vsfr = NULL; + u32 vsfr_size = 0; + void *p = NULL; vsfr = (struct hfi_sfr_struct *)device->sfr.align_virtual_addr; if (vsfr) { - void *p = memchr(vsfr->rg_data, '\0', vsfr->bufSize); - /* - * SFR isn't guaranteed to be NULL terminated - * since SYS_ERROR indicates that Venus is in the - * process of crashing. - */ + vsfr_size = vsfr->bufSize - sizeof(u32); + p = memchr(vsfr->rg_data, '\0', vsfr_size); + /* SFR isn't guaranteed to be NULL terminated */ if (p == NULL) - vsfr->rg_data[vsfr->bufSize - 1] = '\0'; + vsfr->rg_data[vsfr_size - 1] = '\0'; d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data); } @@ -2661,8 +2660,6 @@ static int __response_handler(struct venus_hfi_device *device) } if (call_venus_op(device, watchdog, device->intr_status)) { - struct hfi_sfr_struct *vsfr = (struct hfi_sfr_struct *) - device->sfr.align_virtual_addr; struct msm_vidc_cb_info info = { .response_type = HAL_SYS_WATCHDOG_TIMEOUT, .response.cmd = { @@ -2670,8 +2667,7 @@ static int __response_handler(struct venus_hfi_device *device) } }; - if (vsfr) - d_vpr_e("SFR Message from FW: %s\n", vsfr->rg_data); + print_sfr_message(device); d_vpr_e("Received watchdog timeout\n"); packets[packet_count++] = info; @@ -2695,7 +2691,7 @@ static int __response_handler(struct venus_hfi_device *device) /* Process the packet types that we're interested in */ switch (info->response_type) { case HAL_SYS_ERROR: - __process_sys_error(device); + print_sfr_message(device); break; case HAL_SYS_RELEASE_RESOURCE_DONE: d_vpr_h("Received SYS_RELEASE_RESOURCE\n");