From fa2c98ac0ee7cd63f4b5b36edc1e879b85cf5ed3 Mon Sep 17 00:00:00 2001 From: Haseeb Khan Date: Fri, 11 Dec 2020 16:40:42 +0530 Subject: [PATCH] msm: cvp: Fix to avoid cache entry for unwanted buffer Error handle to avoid dereferencing of unwanted buffer during deinit Change-Id: I0414c18b5a0bba1e1f915c59ba99cce82c0e98fe Signed-off-by: Haseeb Khan --- drivers/media/platform/msm/cvp/msm_cvp_buf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/msm/cvp/msm_cvp_buf.c b/drivers/media/platform/msm/cvp/msm_cvp_buf.c index f52a7af0b1b4..9b9dbd456c42 100644 --- a/drivers/media/platform/msm/cvp/msm_cvp_buf.c +++ b/drivers/media/platform/msm/cvp/msm_cvp_buf.c @@ -382,7 +382,11 @@ static struct msm_cvp_smem *msm_cvp_session_get_smem(struct msm_cvp_inst *inst, rc = msm_cvp_map_smem(inst, smem, "map cpu"); if (rc) goto exit; - + if (buf->size > smem->size || buf->size > smem->size - buf->offset) { + dprintk(CVP_ERR, "%s: invalid offset %d or size %d for a new entry\n", + __func__, buf->offset, buf->size); + goto exit2; + } rc = msm_cvp_session_add_smem(inst, smem); if (rc && rc != -ENOMEM) goto exit2;