evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: vidc: remove additional checks in response_handler

Browse source 
possibility of OOB access on device->response_pkt in
__response_handler. for e.x if msg queue contains 1000
messages and all 1000 were read and queue is empty.
So __get_q_size api will return zero and _iface_msgq_read
will go in an infinite loop, even if packet_count
== max_packets.

Change-Id: I3c0fb095feff0ba5d4d6dab65ed9d5111f1b6f05
Signed-off-by: Govindaraj Rajagopal <grajagop@codeaurora.org>
This commit is contained in:
Govindaraj Rajagopal 2019-12-13 16:15:51 +05:30 • committed by Gerrit - the friendly Code Review server
parent a4fda00580
commit 6c606f6009
1 changed files with 1 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
drivers/media/platform/msm/vidc/venus_hfi.c
View file

@ -2371,34 +2371,6 @@ static int venus_hfi_core_release(void *dev)
return rc; return rc;
} }
static int __get_q_size(struct venus_hfi_device *dev, unsigned int q_index)
{
struct hfi_queue_header *queue;
struct vidc_iface_q_info *q_info;
u32 write_ptr, read_ptr;
if (q_index >= VIDC_IFACEQ_NUMQ) {
dprintk(VIDC_ERR, "Invalid q index: %d\n", q_index);
return -ENOENT;
}
q_info = &dev->iface_queues[q_index];
if (!q_info) {
dprintk(VIDC_ERR, "cannot read shared Q's\n");
return -ENOENT;
}
queue = (struct hfi_queue_header *)q_info->q_hdr;
if (!queue) {
dprintk(VIDC_ERR, "queue not present\n");
return -ENOENT;
}
write_ptr = (u32)queue->qhdr_write_idx;
read_ptr = (u32)queue->qhdr_read_idx;
return read_ptr - write_ptr;
}
static void __core_clear_interrupt(struct venus_hfi_device *device) static void __core_clear_interrupt(struct venus_hfi_device *device)
{ {
u32 intr_status = 0; u32 intr_status = 0;
@ -3671,8 +3643,7 @@ static int __response_handler(struct venus_hfi_device *device)
*session_id = session->session_id; *session_id = session->session_id;
} }
if (packet_count >= max_packets && if (packet_count >= max_packets) {
__get_q_size(device, VIDC_IFACEQ_MSGQ_IDX)) {
dprintk(VIDC_WARN, dprintk(VIDC_WARN,
"Too many packets in message queue to handle at once, deferring read\n"); "Too many packets in message queue to handle at once, deferring read\n");
break; break;