From d7c484822f8201cfc064ca6d0c7702cdba38eed2 Mon Sep 17 00:00:00 2001 From: Pulkit Singh Tak Date: Mon, 6 Jan 2025 16:28:14 +0530 Subject: [PATCH] msm: eva: Validating the SFR buffer size before accessing To avoid any OOB write or other security issues, it's good to validate the buffer size before accessing it. Change-Id: Ibfdef21293c9385119cfb6338ef36e20c0fc1f2f Signed-off-by: Pulkit Singh Tak (cherry picked from commit 8ee6cd6bef52b65e6afba63310e07891e39eb38e) --- drivers/media/platform/msm/cvp/cvp_hfi.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/msm/cvp/cvp_hfi.c b/drivers/media/platform/msm/cvp/cvp_hfi.c index fc4236397575..a38603f89ae3 100644 --- a/drivers/media/platform/msm/cvp/cvp_hfi.c +++ b/drivers/media/platform/msm/cvp/cvp_hfi.c @@ -2757,17 +2757,19 @@ skip_power_off: static void __process_sys_error(struct iris_hfi_device *device) { struct cvp_hfi_sfr_struct *vsfr = NULL; + u32 sfr_buf_size = 0; vsfr = (struct cvp_hfi_sfr_struct *)device->sfr.align_virtual_addr; - if (vsfr) { - void *p = memchr(vsfr->rg_data, '\0', vsfr->bufSize); + sfr_buf_size = vsfr->bufSize; + if (vsfr && sfr_buf_size < ALIGNED_SFR_SIZE) { + void *p = memchr(vsfr->rg_data, '\0', sfr_buf_size); /* * SFR isn't guaranteed to be NULL terminated * since SYS_ERROR indicates that Iris is in the * process of crashing. */ if (p == NULL) - vsfr->rg_data[vsfr->bufSize - 1] = '\0'; + vsfr->rg_data[sfr_buf_size - 1] = '\0'; dprintk(CVP_ERR, "SFR Message from FW: %s\n", vsfr->rg_data);