Invalid input from user can lead to an index going below the valid
range after offset calculation. Existing validation only checked
the upper bound, allowing negative values to pass and cause
out-of-bounds memory access.
Add complete bounds validation to ensure safe access.
CRs-Fixed: 4544133
Change-Id: Ib37b25ab84e9004eaeb216302857d65df18a2516
Signed-off-by: Parag Singhal <parsin@qti.qualcomm.com>
(cherry picked from commit d6cee3f552be8126f0c8b29ea833228bf3357fa8)
Fix potential illegal acquire_hw memory access due to following
scenario. Even though ioctl is synchronous, the kernel performs
1. copy_from_user(&api_version, ...) — reads just the version.
2. Allocates buffer based on version.
3. copy_from_user(acquire_ptr, ...) — reads the full structure.
If another thread modifies the user-space buffer (cmd->handle)
between steps 1 and 3, the kernel will
* Allocate a buffer for version 1.
* But read data formatted for version 1, by modifying api version v2.
* Call the isp_ctx: acquire_hw_in_acquired.
* Now even though the allocated strructure version is v1, in
acquire_hw_in_acquired call to api of version v2 would get invoked.
* Leading to OOB reads/writes.
CRs-Fixed: 4216838
Change-Id: I88d1c76438b56d6ccfa014aa440a536ac5bdd27a
Signed-off-by: Vivek Yadav <viveyada@qti.qualcomm.com>
(cherry picked from commit 55273537c3c23152bba518402a96a86918e3f56c)
After getting the mapped buffer through cam_mem_get_cpu_buf()
in kernel, userspace is still able to access those buffers.
This change copy ois packet header in kernel to avoid TOCTOU
issue.
CRs-Fixed: 3885381
Change-Id: I185381f81a6a736a029b516dc7f99cce1cac7129
Signed-off-by: chengxue <quic_chengxue@quicinc.com>
Get i2c setting count twice in different location for i2c setting,
may lead to out of bound for reg settings. Record i2c setting count
in the first fetch to avoid this risk.
CRs-Fixed: 3885312
Change-Id: I2a81410fecdf41910d7d2eb0daf233621fe0b452
Signed-off-by: jinguiw <quic_jinguiw@quicinc.com>
There are only limitations for CAM_BUF_IN and CAM_BUF_OUT in
config validation, but there will be CAM_BUF_IN_OUT type also.
In process io config, both CAM_BUF_OUT and CAM_BUF_IN_OUT types
are in out_map_entries. No limitation for CAM_BUF_IN_OUT will
lead to out of bound for out_map_entries. This change adds check
for num of io config need in out_map_entries to avoid
out of bound risk.
CRs-Fixed: 3857308
Change-Id: I69163a4264d226d617cbe4f37ba1deb4e6434e31
Signed-off-by: jinguiw <quic_jinguiw@quicinc.com>
No check for cpu buffer offset, which may lead to out of cpu buffer
map. No check for cmd buffer index, which may lead to out of bound
or negative index. Adding check for cpu buffer map offset and
adding check for cmd buffer index.
CRs-Fixed: 3864084
Change-Id: I39494b0a9f323cb5569d37a0c033b2eaf8fbd32c
Signed-off-by: jinguiw <quic_jinguiw@quicinc.com>
- Proper Handling in case of invalid pinctrl index
- Removing dead code and unused variables
- Change to dereference s_ctrl only after proper
NULL Dereference Check.
CRs-Fixed: 3875406
Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da
Signed-off-by: Swami Reddy Reddy <quic_swamired@quicinc.com>
(cherry picked from commit 79d77de659ef7ae0727af4165c5894804ab72d60)
- Proper Handling in case of invalid pinctrl index
- Removing dead code and unused variables
- Change to dereference s_ctrl only after proper
NULL Dereference Check.
CRs-Fixed: 3875406
Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da
Signed-off-by: Swami Reddy Reddy <quic_swamired@quicinc.com>
Currently krefcount is using by umd and kmd. Due to sometimes
there is issue in umd, such as release twice. That maybe causes
buffer release before kmd access the buffer. This commit add
a new refcount to track umd in use buffers and use current krefcount
to track kmd in use buffers. For the same buffer use in kmd and umd
only when all refcount become zero, the buffer start to release.
CRs-Fixed: 3692103
Change-Id: I5a58d9bab4c82bdb192d6a6a3d2b3d254dc04c9e
Signed-off-by: zhuo <quic_zhuo@quicinc.com>
I2C cmd is coming from user space which can be modified due to
access to shared memory. This change scopes the data locally so
as to avoid vulnerability of count being modified by external
means while executing due to being in shared memory.
CRs-Fixed: 3707472
Change-Id: I8a89e23e99b80b089ed4c4cf3098feead752356e
Signed-off-by: Shivi Mangal <quic_smangal@quicinc.com>
(cherry picked from commit 4e00cc5f9f81bf471d58ee5d6beb210a5326fcff)
(cherry picked from commit 6245be68a914dd9984c259ab3c6bc1647c1593be)
Power count is coming from user space which can be modified due to
access to shared memory. This change scopes the data locally so
as to avoid vulnerability of count being modified by external
means while executing due to being in shared memory.
CRs-Fixed: 3691744.
Change-Id: I57d13435453195f8aab0c9aad4414d290274ff81
Signed-off-by: Shivi Mangal <quic_smangal@quicinc.com>
This change add calls to put cpu buf in few scenarios.
CRs-Fixed: 3578162
Change-Id: Iab6aa0324b5072390b38df296c7acee00f5102a1
Signed-off-by: Vikram Sharma <quic_vikramsa@quicinc.com>
Signed-off-by: Nirmal Abraham <quic_c_nabrah@quicinc.com>
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
Signed-off-by: Pranav Sanwal <quic_psanwal@quicinc.com>
We need to check if the packet is valid before using it.
CRs-Fixed: 3605421
Change-Id: Ide4e005ba46690c1cac02cb77a2d9aaa497b15df
Signed-off-by: Yash Upadhyay <quic_yupadhya@quicinc.com>
(cherry picked from commit 2a55b109db91e8302f023f25295b564df9ef400c)
Call cam_mem_put_cpu_buf corresponding to
cam_mem_get_cpu_buf calls to make sure ref_cnt
is balanced and buffer is freed when all
clients are done with the buffer usage.
CRs-Fixed: 3547081
Change-Id: I9414829d6f17c368f2718fe05dbe25c71b31e674
Signed-off-by: Nirmal Abraham <quic_c_nabrah@quicinc.com>
The function cam_mem_mgr_release can unmap buffers when in use.
This change with cam_mem_put_cpu_buf prevents unmaping the buffers in use.
CRs-Fixed: 3489559
Change-Id: I9c4e284c5961a2eb4ff0df362c93d6cea7d77cab
Signed-off-by: illa lakshmi soujanya <quic_illa@quicinc.com>
The function cam_mem_mgr_release can unmap the buffers when in use.
This change prevents unmapping the buffers when in use.
CRs-Fixed: 3489559
Change-Id: I2e72e795d39ac15abfa56c19043c419a03686966
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
Signed-off-by: Gaurav Jindal <quic_gjindal@quicinc.com>
This change is to validate session, device and link handle.
Also, checks whether the device handle belongs to
correct session handle or not.
CRs-Fixed: 3496553
Change-Id: I6b86bf7d0908a280e90e085a3b3e1727facdf8c6
Signed-off-by: Karthik Dillibabu <quic_kard@quicinc.com>
For requests with multiple BL tags,in a corner case,
cdm work notifies out of order requests to client as
difference in bl_tags is greater than boundary check.
This commit avoids out of order request processing by
making number of inflight work to be 1 and increasing
the priority of workqueue. And therefore removed all
checks that are not required.
CRs-Fixed: 3453131
Change-Id: I6db3e9379b2474347cff1618ea6ad705ca3561fb
Signed-off-by: zhuo <quic_zhuo@quicinc.com>
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
Problem:
Check IRQ status on hang detection if the inline IRQ
is set then the cdm has triggered IRQ but there is a
workqueue scheduling delay which is causing the cdm's
config timeout.
Solution:
To prevent the timeout due to
scheduling delay check the work record and irq status
and return true if its delay.
CRs-Fixed: 3433175
Change-Id: Iaa34f8ff9b57e7da9f80677a7da9b4f9a53dad14
Signed-off-by: Yash Upadhyay <quic_yupadhya@quicinc.com>
In OPE fault handler, while dumping pf info ctx_mutex is
acquired and corresponding page fault ops is called. In
pagefault ops same mutex is getting acquired again causing
a dead lock.
This commit avoids locking the same mutex again.
CRs-Fixed: 3419490
Change-Id: I2e37f725865d091f2cb682fc62f5d21278b93959
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
Due to race condition, fd pointing to a particular dma buf
is released by userspace before incrementing ref count and
hence freed that dma buf. When the call returns it still uses
the freed dma buf causing use-after-free.
This fix includes get_file API to increment ref count
before dma_buf_fd.
CRs-Fixed: 3341070
Change-Id: I8ebc37b4ceb5f8691bbbb3d26b8b64878d832fbe
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
This change is to validate BL command length and
addresses before submitting to CDM. Also as part
of recovery avoids moving wrong packet submit request
to pending queue.
CRs-Fixed: 3342983
Change-Id: I15f082cdd4d54ad6bf0e446115780829b3b711dd
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
In case of early bufones, signalling fence for few
ports are missed for target which do not support
last consumed address which result in a unsignalled fence
Issue is fixed by handling early bufdones and signalling
success for resource which got early bufdone.
CRs-Fixed: 3333269
Change-Id: I0a56f770806d48034bcc45d2ca68d8f9adcc8eee
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
In TFE top-half handler, TOP register status is read first and
then based on top register status, bus register status is read.
There could be a corner case where bufdone irq top-half handling
is ongoing, top status registers are read, and while reading bus
register status we might have got SOF and RUP irqs. Since RUP and
Bufdone both come from bus side, RUP bit is set during this bus
register read. Hence, RUP is handled first along with bufdone and
then SOF irq is handled. There is no handling in statemachine for
such RUP's in RDI only context statemachine. Hence leading to
bubble condition resulting in frame drop
To overcome such scenario, handling for RUP in applied substate
is introduced in RDI only statemachine.
CRs-Fixed: 3298719
Change-Id: I5cc8a0c122aa09c22da6536303f849344454c480
Signed-off-by: Shivakumar Malke <quic_smalke@quicinc.com>
Fd is a user-accessible value, referring it multiple times
leads to TOCTOU issues. Dma_buf can be freed after the 1st
use of fd and userspace can create another dma_buf but with
same fd. In such scenario, during 2nd use of fd, we may get
a different dma_buf with different length. To avoid this, we
can use same dma_buf instead of retrieving it twice using same
fd. In this change FD is accessed only once in syscall.
CRs-Fixed: 3159446
Change-Id: I00eb6dd3d798165f5c6c0bd59feabe80a68592b1
Signed-off-by: Yash Upadhyay <quic_yupadhya@quicinc.com>
