lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: vidc: add additional check to avoid out of bound access

Browse Source 
pkt->msg_size can be corrupted, that leads to OOB access. So added
additional conditional check to avoid OOB access in debug queue
packet handling.

Change-Id: I360812c40369ecef2dd99464d400661bc785074b
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
This commit is contained in:
Govindaraj Rajagopal 2019-06-07 18:21:54 +05:30
parent fe44bca0c0
commit fc8664564a
2 changed files with 39 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
msm/vidc/hfi_common.c
View File

@ -36,6 +36,7 @@
#define FIRMWARE_SIZE 0X00A00000
#define REG_ADDR_OFFSET_BITMASK 0x000FFFFF
#define QDSS_IOVA_START 0x80001000
#define MIN_PAYLOAD_SIZE 3
static struct hal_device_data hal_ctxt;
@ -3261,22 +3262,50 @@ static void __flush_debug_queue(struct venus_hfi_device *device, u8 *packet)
log_level |= FW_PRINTK;
}
#define SKIP_INVALID_PKT(pkt_size, payload_size, pkt_hdr_size) ({ \
if (pkt_size < pkt_hdr_size || \
payload_size < MIN_PAYLOAD_SIZE || \
payload_size > \
(pkt_size - pkt_hdr_size + sizeof(u8))) { \
dprintk(VIDC_ERR, \
"%s: invalid msg size - %d\n", \
__func__, pkt->msg_size); \
continue; \
} \
})
while (!__iface_dbgq_read(device, packet)) {
struct hfi_msg_sys_coverage_packet *pkt =
(struct hfi_msg_sys_coverage_packet *) packet;
struct hfi_packet_header *pkt =
(struct hfi_packet_header *) packet;
if (pkt->size < sizeof(struct hfi_packet_header)) {
dprintk(VIDC_ERR, "Invalid pkt size - %s\n",
__func__);
continue;
}
if (pkt->packet_type == HFI_MSG_SYS_COV) {
struct hfi_msg_sys_coverage_packet *pkt =
(struct hfi_msg_sys_coverage_packet *) packet;
int stm_size = 0;
SKIP_INVALID_PKT(pkt->size,
pkt->msg_size, sizeof(*pkt));
stm_size = stm_log_inv_ts(0, 0,
pkt->rg_msg_data, pkt->msg_size);
if (stm_size == 0)
dprintk(VIDC_ERR,
"In %s, stm_log returned size of 0\n",
__func__);
} else {
} else if (pkt->packet_type == HFI_MSG_SYS_DEBUG) {
struct hfi_msg_sys_debug_packet *pkt =
(struct hfi_msg_sys_debug_packet *) packet;
SKIP_INVALID_PKT(pkt->size,
pkt->msg_size, sizeof(*pkt));
/*
* All fw messages starts with new line character. This
* causes dprintk to print this message in two lines
@ -3284,9 +3313,11 @@ static void __flush_debug_queue(struct venus_hfi_device *device, u8 *packet)
* from the message fixes this to print it in a single
* line.
*/
pkt->rg_msg_data[pkt->msg_size-1] = '\0';
dprintk_firmware(log_level, "%s", &pkt->rg_msg_data[1]);
}
}
#undef SKIP_INVALID_PKT
if (local_packet)
kfree(packet);

5
msm/vidc/vidc_hfi_helper.h
View File

@ -839,6 +839,11 @@ struct vidc_hal_session_cmd_pkt {
u32 session_id;
};
struct hfi_packet_header {
u32 size;
u32 packet_type;
};
struct hfi_cmd_sys_init_packet {
u32 size;
u32 packet_type;