From f1e149c74a29787097beb9ec5ab0897f365d080b Mon Sep 17 00:00:00 2001 From: Govindaraj Rajagopal Date: Wed, 11 Dec 2019 11:02:13 +0530 Subject: [PATCH] msm: vidc: remove additional checks in response_handler possibility of OOB access on device->response_pkt in __response_handler. for e.x if msg queue contains 1000 messages and all 1000 were read and queue is empty. So __get_q_size api will return zero and _iface_msgq_read will go in an infinite loop, even if packet_count == max_packets. Change-Id: I3c0fb095feff0ba5d4d6dab65ed9d5111f1b6f05 Signed-off-by: Govindaraj Rajagopal --- msm/vidc/hfi_common.c | 31 +------------------------------ 1 file changed, 1 insertion(+), 30 deletions(-) diff --git a/msm/vidc/hfi_common.c b/msm/vidc/hfi_common.c index 728bf8b73e6c..28bfbab2498f 100644 --- a/msm/vidc/hfi_common.c +++ b/msm/vidc/hfi_common.c @@ -1740,34 +1740,6 @@ static int venus_hfi_core_release(void *dev) return rc; } -static int __get_q_size(struct venus_hfi_device *dev, unsigned int q_index) -{ - struct hfi_queue_header *queue; - struct vidc_iface_q_info *q_info; - u32 write_ptr, read_ptr; - - if (q_index >= VIDC_IFACEQ_NUMQ) { - d_vpr_e("Invalid q index: %d\n", q_index); - return -ENOENT; - } - - q_info = &dev->iface_queues[q_index]; - if (!q_info) { - d_vpr_e("cannot read shared Q's\n"); - return -ENOENT; - } - - queue = (struct hfi_queue_header *)q_info->q_hdr; - if (!queue) { - d_vpr_e("queue not present\n"); - return -ENOENT; - } - - write_ptr = (u32)queue->qhdr_write_idx; - read_ptr = (u32)queue->qhdr_read_idx; - return read_ptr - write_ptr; -} - static int venus_hfi_core_trigger_ssr(void *device, enum hal_ssr_trigger_type type) { @@ -2795,8 +2767,7 @@ static int __response_handler(struct venus_hfi_device *device) *inst_id = session->inst_id; } - if (packet_count >= max_packets && - __get_q_size(device, VIDC_IFACEQ_MSGQ_IDX)) { + if (packet_count >= max_packets) { d_vpr_e( "Too many packets in message queue to handle at once, deferring read\n"); break;