A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: vidc: remove additional checks in response_handler

Browse source 
possibility of OOB access on device->response_pkt in
__response_handler. for e.x if msg queue contains 1000
messages and all 1000 were read and queue is empty.
So __get_q_size api will return zero and _iface_msgq_read
will go in an infinite loop, even if packet_count
== max_packets.

Change-Id: I3c0fb095feff0ba5d4d6dab65ed9d5111f1b6f05
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
This commit is contained in:
Govindaraj Rajagopal 2019-12-11 11:02:13 +05:30 • committed by Mihir Ganu
commit f1e149c74a
1 changed files with 1 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

31
msm/vidc/hfi_common.c
View file

@ -1740,34 +1740,6 @@ static int venus_hfi_core_release(void *dev)
return rc;
}
static int __get_q_size(struct venus_hfi_device *dev, unsigned int q_index)
{
struct hfi_queue_header *queue;
struct vidc_iface_q_info *q_info;
u32 write_ptr, read_ptr;
if (q_index >= VIDC_IFACEQ_NUMQ) {
d_vpr_e("Invalid q index: %d\n", q_index);
return -ENOENT;
}
q_info = &dev->iface_queues[q_index];
if (!q_info) {
d_vpr_e("cannot read shared Q's\n");
return -ENOENT;
}
queue = (struct hfi_queue_header *)q_info->q_hdr;
if (!queue) {
d_vpr_e("queue not present\n");
return -ENOENT;
}
write_ptr = (u32)queue->qhdr_write_idx;
read_ptr = (u32)queue->qhdr_read_idx;
return read_ptr - write_ptr;
}
static int venus_hfi_core_trigger_ssr(void *device,
enum hal_ssr_trigger_type type)
{
@ -2795,8 +2767,7 @@ static int __response_handler(struct venus_hfi_device *device)
*inst_id = session->inst_id;
}
if (packet_count >= max_packets &&
__get_q_size(device, VIDC_IFACEQ_MSGQ_IDX)) {
if (packet_count >= max_packets) {
d_vpr_e(
"Too many packets in message queue to handle at once, deferring read\n");
break;