From 5685ecf200d69561febc853ca060ad0440cdd134 Mon Sep 17 00:00:00 2001 From: Ashish Bhimanpalliwar Date: Wed, 3 Aug 2022 11:04:07 +0530 Subject: [PATCH] msm: camera: common: Add conditions to catch invalid packet data Add conditions to catch invalid cmd_desc, io buffers, and kmd buffers in the packet payload. CRs-Fixed: 3250331 Change-Id: I2db474572a8c5391ba9b9821de2da0db8f10eb4d Signed-off-by: Ashish Bhimanpalliwar --- drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c | 3 ++- .../cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c | 4 ++-- drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 7 ++++--- drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c | 6 ++++++ drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c | 6 ++++-- .../cam_csiphy/cam_csiphy_core.c | 18 +++++++++++++++--- drivers/cam_utils/cam_packet_util.c | 13 +++++++++++++ 7 files changed, 46 insertions(+), 11 deletions(-) diff --git a/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c index 3035982861ee..33566f8fb403 100644 --- a/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c +++ b/drivers/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -54,7 +55,7 @@ static int cam_fd_mgr_util_packet_validate(struct cam_packet *packet, } /* All buffers must come through io config, do not support patching */ - if (packet->num_patches || !packet->num_io_configs) { + if (packet->num_patches || !packet->num_io_configs || !packet->num_cmd_buf) { CAM_ERR(CAM_FD, "wrong number of cmd/patch info: %u %u", packet->num_cmd_buf, packet->num_patches); return -EINVAL; diff --git a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c index d6a1ecee86f9..a6ef5560594e 100644 --- a/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c +++ b/drivers/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c @@ -4189,13 +4189,13 @@ static int cam_icp_mgr_pkt_validation(struct cam_packet *packet) return -EINVAL; } - if (packet->num_io_configs > IPE_IO_IMAGES_MAX) { + if (!packet->num_io_configs || packet->num_io_configs > IPE_IO_IMAGES_MAX) { CAM_ERR(CAM_ICP, "Invalid number of io configs: %d %d", IPE_IO_IMAGES_MAX, packet->num_io_configs); return -EINVAL; } - if (packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) { + if (!packet->num_cmd_buf || packet->num_cmd_buf > CAM_ICP_CTX_MAX_CMD_BUFFERS) { CAM_ERR(CAM_ICP, "Invalid number of cmd buffers: %d %d", CAM_ICP_CTX_MAX_CMD_BUFFERS, packet->num_cmd_buf); return -EINVAL; diff --git a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c index 5d72d910ad37..a7580fc0a205 100644 --- a/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +++ b/drivers/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -769,8 +769,9 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, return rc; } - if ((packet->num_cmd_buf > 5) || !packet->num_patches || - !packet->num_io_configs || + if (!packet->num_cmd_buf || + (packet->num_cmd_buf > 5) || + !packet->num_patches || !packet->num_io_configs || (packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) { CAM_ERR(CAM_JPEG, "wrong number of cmd/patch/io_configs info: %u %u %u", diff --git a/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c b/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c index d878271403d1..53ca5442e03f 100644 --- a/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c +++ b/drivers/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -113,6 +114,11 @@ static int cam_lrme_mgr_util_packet_validate(struct cam_packet *packet, return -EINVAL; } + if (!packet->num_cmd_buf) { + CAM_ERR(CAM_LRME, "no cmd bufs"); + return -EINVAL; + } + cmd_desc = (struct cam_cmd_buf_desc *)((uint8_t *)&packet->payload + packet->cmd_buf_offset); diff --git a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c index b76f97a7461c..9f16f0f48084 100644 --- a/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c +++ b/drivers/cam_ope/ope_hw_mgr/cam_ope_hw_mgr.c @@ -2379,13 +2379,15 @@ static int cam_ope_mgr_pkt_validation(struct cam_packet *packet) return -EINVAL; } - if (packet->num_io_configs > OPE_MAX_IO_BUFS) { + if (!packet->num_io_configs || + packet->num_io_configs > OPE_MAX_IO_BUFS) { CAM_ERR(CAM_OPE, "Invalid number of io configs: %d %d", OPE_MAX_IO_BUFS, packet->num_io_configs); return -EINVAL; } - if (packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) { + if (!packet->num_cmd_buf || + packet->num_cmd_buf > OPE_PACKET_MAX_CMD_BUFS) { CAM_ERR(CAM_OPE, "Invalid number of cmd buffers: %d %d", OPE_PACKET_MAX_CMD_BUFS, packet->num_cmd_buf); return -EINVAL; diff --git a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c index 06c02c1932f1..c1a2a53c9d10 100644 --- a/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c +++ b/drivers/cam_sensor_module/cam_csiphy/cam_csiphy_core.c @@ -393,9 +393,21 @@ int32_t cam_cmd_buf_parser(struct csiphy_device *csiphy_dev, return rc; } - cmd_desc = (struct cam_cmd_buf_desc *) - ((uint32_t *)&csl_packet->payload + - csl_packet->cmd_buf_offset / 4); + if (csl_packet->num_cmd_buf) + cmd_desc = (struct cam_cmd_buf_desc *) + ((uint32_t *)&csl_packet->payload + + csl_packet->cmd_buf_offset / 4); + else { + CAM_ERR(CAM_CSIPHY, "num_cmd_buffers = %d", csl_packet->num_cmd_buf); + rc = -EINVAL; + return rc; + } + + rc = cam_packet_util_validate_cmd_desc(cmd_desc); + if (rc) { + CAM_ERR(CAM_CSIPHY, "Invalid cmd desc ret: %d", rc); + return rc; + } rc = cam_mem_get_cpu_buf(cmd_desc->mem_handle, &generic_ptr, &len); diff --git a/drivers/cam_utils/cam_packet_util.c b/drivers/cam_utils/cam_packet_util.c index ebcd36cd4e11..ba0c93086c55 100644 --- a/drivers/cam_utils/cam_packet_util.c +++ b/drivers/cam_utils/cam_packet_util.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -40,6 +41,12 @@ int cam_packet_util_get_cmd_mem_addr(int handle, uint32_t **buf_addr, int cam_packet_util_validate_cmd_desc(struct cam_cmd_buf_desc *cmd_desc) { + + if (!cmd_desc) { + CAM_ERR(CAM_UTIL, "Invalid cmd desc"); + return -EINVAL; + } + if ((cmd_desc->length > cmd_desc->size) || (cmd_desc->mem_handle <= 0)) { CAM_ERR(CAM_UTIL, "invalid cmd arg %d %d %d %d", @@ -80,6 +87,7 @@ int cam_packet_util_validate_packet(struct cam_packet *packet, pkt_wo_payload = offsetof(struct cam_packet, payload); if ((!packet->header.size) || + ((size_t)packet->header.size <= pkt_wo_payload) || ((pkt_wo_payload + (size_t)packet->cmd_buf_offset + sum_cmd_desc) > (size_t)packet->header.size) || ((pkt_wo_payload + (size_t)packet->io_configs_offset + @@ -109,6 +117,11 @@ int cam_packet_util_get_kmd_buffer(struct cam_packet *packet, return -EINVAL; } + if (!packet->num_cmd_buf) { + CAM_ERR(CAM_UTIL, "Invalid num_cmd_buf = %d", packet->num_cmd_buf); + return -EINVAL; + } + if ((packet->kmd_cmd_buf_index < 0) || (packet->kmd_cmd_buf_index >= packet->num_cmd_buf)) { CAM_ERR(CAM_UTIL, "Invalid kmd buf index: %d",