From 833bd8ca3cf32278ccd3fab651d1cb37935d82b1 Mon Sep 17 00:00:00 2001 From: suchawla Date: Fri, 3 Jan 2020 12:31:50 +0530 Subject: [PATCH] msm: cvp: remove additional checks in response_handler possibility of OOB access on device->response_pkt in __response_handler. for e.x if msg queue contains 1000 messages and all 1000 were read and queue is empty. So __get_q_size api will return zero and _iface_msgq_read will go in an infinite loop, even if packet_count == max_packets. Change-Id: I8e64ff70d5bcefb52d66bfea121f3febf4728384 Signed-off-by: suchawla --- drivers/media/platform/msm/cvp/cvp_hfi.c | 33 ++---------------------- 1 file changed, 2 insertions(+), 31 deletions(-) diff --git a/drivers/media/platform/msm/cvp/cvp_hfi.c b/drivers/media/platform/msm/cvp/cvp_hfi.c index 40b061089f5f..b63a1cd7c486 100644 --- a/drivers/media/platform/msm/cvp/cvp_hfi.c +++ b/drivers/media/platform/msm/cvp/cvp_hfi.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved. + * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved. */ #include @@ -2207,34 +2207,6 @@ static int iris_hfi_core_release(void *dev) return rc; } -static int __get_q_size(struct iris_hfi_device *dev, unsigned int q_index) -{ - struct cvp_hfi_queue_header *queue; - struct cvp_iface_q_info *q_info; - u32 write_ptr, read_ptr; - - if (q_index >= CVP_IFACEQ_NUMQ) { - dprintk(CVP_ERR, "Invalid q index: %d\n", q_index); - return -ENOENT; - } - - q_info = &dev->iface_queues[q_index]; - if (!q_info) { - dprintk(CVP_ERR, "cannot read shared Q's\n"); - return -ENOENT; - } - - queue = (struct cvp_hfi_queue_header *)q_info->q_hdr; - if (!queue) { - dprintk(CVP_ERR, "queue not present\n"); - return -ENOENT; - } - - write_ptr = (u32)queue->qhdr_write_idx; - read_ptr = (u32)queue->qhdr_read_idx; - return read_ptr - write_ptr; -} - static void __core_clear_interrupt(struct iris_hfi_device *device) { u32 intr_status = 0, mask = 0; @@ -3158,8 +3130,7 @@ static int __response_handler(struct iris_hfi_device *device) *session_id = session->session_id; } - if (packet_count >= cvp_max_packets && - __get_q_size(device, CVP_IFACEQ_MSGQ_IDX)) { + if (packet_count >= cvp_max_packets) { dprintk(CVP_WARN, "Too many packets in message queue!\n"); break;