From db1e19beb1a5412e927c2bc7988e581959c93904 Mon Sep 17 00:00:00 2001 From: Yu SI Date: Fri, 12 Jun 2020 15:24:47 -0700 Subject: [PATCH 1/2] msm: cvp:fix potential null ptr dereference msghdr fix potential null ptr dereference on cvp_hfi_msg_session_hdr ptr hdr if out is NULL. Change-Id: Ic2c35ddc4438312cb03f0f346e27d0c0b631b95a Signed-off-by: Yu SI --- drivers/media/platform/msm/cvp/msm_cvp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp.c b/drivers/media/platform/msm/cvp/msm_cvp.c index 9e8f9a4a41e1..15126f391118 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp.c +++ b/drivers/media/platform/msm/cvp/msm_cvp.c @@ -111,9 +111,12 @@ static int cvp_wait_process_message(struct msm_cvp_inst *inst, goto exit; } - if (out) - memcpy(out, &msg->pkt, sizeof(struct cvp_hfi_msg_session_hdr)); + if (!out) { + kmem_cache_free(cvp_driver->msg_cache, msg); + goto exit; + } + memcpy(out, &msg->pkt, sizeof(struct cvp_hfi_msg_session_hdr)); kmem_cache_free(cvp_driver->msg_cache, msg); hdr = (struct cvp_hfi_msg_session_hdr *)out; msm_cvp_unmap_frame(inst, hdr->client_data.kdata); From e7ba166ed8da4c6a4585583c36901dba6e5d7c90 Mon Sep 17 00:00:00 2001 From: Yu SI Date: Fri, 12 Jun 2020 17:42:16 -0700 Subject: [PATCH 2/2] msm: cvp:fix potential prop_array idx out range fix potential issue that idx of prop_array could be out of range Change-Id: Ia2d6a7332f66f518b2f8d96ed999e3963f1b9284 Signed-off-by: Yu SI --- drivers/media/platform/msm/cvp/msm_cvp.c | 2 +- include/uapi/media/msm_cvp_private.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp.c b/drivers/media/platform/msm/cvp/msm_cvp.c index 15126f391118..4f8706e63b69 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp.c +++ b/drivers/media/platform/msm/cvp/msm_cvp.c @@ -1125,7 +1125,7 @@ static int msm_cvp_set_sysprop(struct msm_cvp_inst *inst, return -EINVAL; } - if (props->prop_num >= MAX_KMD_PROP_NUM) { + if (props->prop_num >= MAX_KMD_PROP_NUM_PER_PACKET) { dprintk(CVP_ERR, "Too many properties %d to set\n", props->prop_num); return -E2BIG; diff --git a/include/uapi/media/msm_cvp_private.h b/include/uapi/media/msm_cvp_private.h index 68c657ad283a..90046d9eb438 100644 --- a/include/uapi/media/msm_cvp_private.h +++ b/include/uapi/media/msm_cvp_private.h @@ -149,7 +149,8 @@ struct cvp_kmd_hfi_packet { #define CVP_KMD_PROP_PWR_DDR_OP 0x1C #define CVP_KMD_PROP_PWR_SYSCACHE_OP 0x1D -#define MAX_KMD_PROP_NUM (CVP_KMD_PROP_PWR_SYSCACHE_OP + 1) +#define MAX_KMD_PROP_NUM_PER_PACKET 8 +#define MAX_KMD_PROP_TYPE (CVP_KMD_PROP_PWR_SYSCACHE_OP + 1) struct cvp_kmd_sys_property { __u32 prop_type;