A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 20:33:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

BACKPORT: media: venus: hfi: add checks to perform sanity on queue pointers

Browse source 
Read and write pointers are used to track the packet index in the memory
shared between video driver and firmware. There is a possibility of OOB
access if the read or write pointer goes beyond the queue memory size.
Add checks for the read and write pointers to avoid OOB access.

cherry picked from 5e538fce3358 ("media: venus: hfi: add checks to
perform sanity on queue pointers").

Change-Id: I6c280854a7a51e38d92a2923d4c9bfe6a49c0ce2
Cc: stable@vger.kernel.org
Fixes: d96d3f30c0 ("[media] media: venus: hfi: add Venus HFI files")
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
This commit is contained in:
Vikash Garodia 2023-11-29 09:24:47 +05:30
commit ad5ca445f1
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/media/platform/qcom/venus/hfi_venus.c
View file

@ -206,6 +206,11 @@ static int venus_write_queue(struct venus_hfi_device *hdev,
new_wr_idx = wr_idx + dwords;
wr_ptr = (u32 *)(queue->qmem.kva + (wr_idx << 2));
if (wr_ptr < (u32 *)queue->qmem.kva ||
wr_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*wr_ptr)))
return -EINVAL;
if (new_wr_idx < qsize) {
memcpy(wr_ptr, packet, dwords << 2);
} else {
@ -273,6 +278,11 @@ static int venus_read_queue(struct venus_hfi_device *hdev,
}
rd_ptr = (u32 *)(queue->qmem.kva + (rd_idx << 2));
if (rd_ptr < (u32 *)queue->qmem.kva ||
rd_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*rd_ptr)))
return -EINVAL;
dwords = *rd_ptr >> 2;
if (!dwords)
return -EINVAL;