From patchwork Thu Aug 10 02:25:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vikash Garodia X-Patchwork-Id: 133670 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b824:0:b0:3f2:4152:657d with SMTP id z4csp151871vqi; Wed, 9 Aug 2023 20:12:07 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFVXGSf9P+HsPdroqh4H0dq04n8n5hpiy4jE6MzJSsZay7Bmbr9Ci5s7F/pr0HujPZ4K11f X-Received: by 2002:a05:6a20:12c2:b0:131:4808:d5a1 with SMTP id v2-20020a056a2012c200b001314808d5a1mr1258761pzg.28.1691637126723; Wed, 09 Aug 2023 20:12:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691637126; cv=none; d=google.com; s=arc-20160816; b=sQSlvQ6XGZKx6fDHkQg9dJWxjmxBIQ4DGMvv2oeI1H3QhAjwAZj4/B+0KpPVxsRIFO 7gXazHts/Y3gQmD0NhqJThHTyu31327qWYPXyOliNEioiiCa8zmQXTGf+2w7tSV3mZX6 gtg6F9WCRW1y7Vp7ww3bkXfJByYur6A5sXEpj/ZhJSH0y31k6KF2K37LuKugVKjsve2U S72ZVl21kRhOuf8tUzxCTsY0pnyQ+jav9vGuRK6EqI50vj2riNP3E4jxbhTCFWI0nUcm wXvmKusIcSd0h0WvCW1v1KrO6F5Ze/NGkU/2KpPSretTpNmqgO2wqq8wU+siXzuGc1sT pjeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=fybLsQntBjDPeIINYbmncAJXzI627HXW3R0ZrjRa2fg=; fh=GcndwOMBf1bnpW+bW+jgpNWzVvxAZNEz+Wt3jUkG7qY=; b=K6UyiQ5A3eh3EM2VOEdobag1gI6DFB14T+lBp7DQyFiy3wU3tKcfr4CPGjBubpEMDb rxiXnplreTMQ3fgq2J7gz+2P7sZRkCPWnGpePO8LN1tX87sD6GaZxHv7t99PsqASK9At ET7ZUTJEeV6cjZiale4Axdwtduw7XXBwo8JyFirJqR4o9S8ox0SdOyauwDE+xY+xn9kF 4O/B3MkjHBLs3v3p/s5O7bfSX+hazS3X8s/APbsGlS/xQHOUejm+lloradBBbBGXKWrq 5JZ6n4QB94Q7eop9q0jXA44XS4MoZksWSewy+H9bguA417EIUYHuAR84Wb96nFdjPBVM 94cw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=R9v4bwZ2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=quicinc.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id f20-20020a056a00229400b00687357a3793si631925pfe.347.2023.08.09.20.11.49; Wed, 09 Aug 2023 20:12:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@quicinc.com header.s=qcppdkim1 header.b=R9v4bwZ2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=quicinc.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232056AbjHJC0A (ORCPT + 99 others); Wed, 9 Aug 2023 22:26:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229501AbjHJCZ7 (ORCPT ); Wed, 9 Aug 2023 22:25:59 -0400 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1D681999; Wed, 9 Aug 2023 19:25:58 -0700 (PDT) Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 37A2Pa9T028958; Thu, 10 Aug 2023 02:25:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-type; s=qcppdkim1; bh=fybLsQntBjDPeIINYbmncAJXzI627HXW3R0ZrjRa2fg=; b=R9v4bwZ2Ec7+Y7USOvYOhIOX7akrPTserUD10lc8FF+Gt6OPJkQCOpnxH8WekgWZ7rzP A01ooGTa2j1V/xcUIyXzj5oQcr+YWf+zcqOq/s1EGWvxqDRBpcpTjL/4YbrCkuOUtzTN y2WD3E3mv23aNn7r2woXu5ICIKIvLIEBrpjtr0UGDh7d9H/XCP4ijblpUlDwM7znEm4s 3gCZkjbM/XeeCa6b7TPqW14kdipUzPXw08vWYruPp5e6ok94bYobo3wnLWZlZu4OER2n boGtdklLhfZlQkrhBlmPRLL9j9R+7Pb1PPuf+eThNkrC/hLU367pzAxlNnvjpX6280qs /Q== Received: from nasanppmta03.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3sbmrqm84w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 10 Aug 2023 02:25:44 +0000 Received: from nasanex01a.na.qualcomm.com (nasanex01a.na.qualcomm.com [10.52.223.231]) by NASANPPMTA03.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 37A2PiAK011953 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 10 Aug 2023 02:25:44 GMT Received: from hu-vgarodia-hyd.qualcomm.com (10.80.80.8) by nasanex01a.na.qualcomm.com (10.52.223.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.30; Wed, 9 Aug 2023 19:25:40 -0700 From: Vikash Garodia To: , , , , , , , CC: , , , , Vikash Garodia Subject: [PATCH v2 1/4] venus: hfi: add checks to perform sanity on queue pointers Date: Thu, 10 Aug 2023 07:55:01 +0530 Message-ID: <1691634304-2158-2-git-send-email-quic_vgarodia@quicinc.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1691634304-2158-1-git-send-email-quic_vgarodia@quicinc.com> References: <1691634304-2158-1-git-send-email-quic_vgarodia@quicinc.com> MIME-Version: 1.0 X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nasanex01a.na.qualcomm.com (10.52.223.231) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-GUID: OSnrjtdp5uGQiV8Z9Wc4K0Kz8tqYjBvi X-Proofpoint-ORIG-GUID: OSnrjtdp5uGQiV8Z9Wc4K0Kz8tqYjBvi X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.267,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26 definitions=2023-08-10_01,2023-08-09_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 malwarescore=0 adultscore=0 mlxscore=0 suspectscore=0 phishscore=0 mlxlogscore=769 impostorscore=0 priorityscore=1501 clxscore=1015 bulkscore=0 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2306200000 definitions=main-2308100019 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1773810091763128072 X-GMAIL-MSGID: 1773810091763128072 Read and write pointers are used to track the packet index in the memory shared between video driver and firmware. There is a possibility of OOB access if the read or write pointer goes beyond the queue memory size. Add checks for the read and write pointer to avoid OOB access. Cc: stable@vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Signed-off-by: Vikash Garodia --- drivers/media/platform/qcom/venus/hfi_venus.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index f0b4638..4ddabb1 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -206,6 +206,11 @@ static int venus_write_queue(struct venus_hfi_device *hdev, new_wr_idx = wr_idx + dwords; wr_ptr = (u32 *)(queue->qmem.kva + (wr_idx << 2)); + + if (wr_ptr < (u32 *)queue->qmem.kva || + wr_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*wr_ptr))) + return -EINVAL; + if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2); } else { @@ -273,6 +278,11 @@ static int venus_read_queue(struct venus_hfi_device *hdev, } rd_ptr = (u32 *)(queue->qmem.kva + (rd_idx << 2)); + + if (rd_ptr < (u32 *)queue->qmem.kva || + rd_ptr > (u32 *)(queue->qmem.kva + queue->qmem.size - sizeof(*rd_ptr))) + return -EINVAL; + dwords = *rd_ptr >> 2; if (!dwords) return -EINVAL;