From patchwork Thu Nov 28 05:05:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vikash Garodia X-Patchwork-Id: 846383 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8998914A0B7; Thu, 28 Nov 2024 05:05:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732770345; cv=none; b=ZgKuunC9ft1b7qTo6iRaDlrre0AdBD0aqigrJEHphcVm/giEaJiZaiQJvSJ4tIhVu+Mm1/663cmfnY8kBsXKr/Kn43GD50QHxjmPywVAOlQQ+O1JmVLnZENYZeNSirvOSoHo/HfKa4McWWEb5owxSXxAgSjbu0fByLmNgtT03H4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732770345; c=relaxed/simple; bh=momNFG7HmrlvZT1BkDBQhwhSFM+A1S+Ius0MDXLSgYE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=n78aBxScbPrYCssdxrbJ59bLS0iF+LjnOTsG8RurrrDix4Hvh0M4bP8jfzwasEWIcqHARU/Y3vFw0hO2qYs7KGblJvHKfXAdESd1aaDRhVEN4n6z8R149vVje9vAmc1bJg8F0JnSVQBKEWQTp0/7qVx6z9Nbud8f9uoaICBoy7k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=quicinc.com; spf=pass smtp.mailfrom=quicinc.com; dkim=pass (2048-bit key) header.d=quicinc.com header.i=@quicinc.com header.b=GWFCXK1r; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=quicinc.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=quicinc.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=quicinc.com header.i=@quicinc.com header.b="GWFCXK1r" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 4ARGQqFN029608; Thu, 28 Nov 2024 05:05:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= dwccvR0I8r73vh8lHYvXtH8o48ByEI6FWFPxtm9adwg=; b=GWFCXK1rLmso1+BL UjjuHoET//5Q4dig1Xg6WQxtMG60sYQDjmWph3GihGixcaUe8wUKeSABNF83lnZk UzYXog9pr254VaWogHtSw6tRpOTCgoEOGvLiaGMH4Fs80NZDMtO4tEmxxgOu2jqp zKJtDmM1vQAnv7j9INSwzG9vpaBPqwJGH+l2LpRJqNElNTt8dtaS1re7mM0oXePq bDqCsVSIiscsaxgsuCbFu5tHXWxI4+xXMzF5mov3aaasqYLaqer6EY9IHP6vHHki QdLD5ZrGTkXlNtBq9UUXtC0sBAnkH7qPDgWEhDw0z4PVrfO1ZclcASObokx6zCZq +9ONfA== Received: from nasanppmta01.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4366xxhd1d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Nov 2024 05:05:38 +0000 (GMT) Received: from nasanex01a.na.qualcomm.com (nasanex01a.na.qualcomm.com [10.52.223.231]) by NASANPPMTA01.qualcomm.com (8.18.1.2/8.18.1.2) with ESMTPS id 4AS55bX5013967 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 28 Nov 2024 05:05:37 GMT Received: from hu-vgarodia-hyd.qualcomm.com (10.80.80.8) by nasanex01a.na.qualcomm.com (10.52.223.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.9; Wed, 27 Nov 2024 21:05:33 -0800 From: Vikash Garodia Date: Thu, 28 Nov 2024 10:35:14 +0530 Subject: [PATCH v2 4/4] media: venus: hfi: add a check to handle OOB in sfr region Precedence: bulk X-Mailing-List: linux-arm-msm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <20241128-venus_oob_2-v2-4-483ae0a464b8@quicinc.com> References: <20241128-venus_oob_2-v2-0-483ae0a464b8@quicinc.com> In-Reply-To: <20241128-venus_oob_2-v2-0-483ae0a464b8@quicinc.com> To: Stanimir Varbanov , Bryan O'Donoghue , Mauro Carvalho Chehab , Tomasz Figa , Hans Verkuil CC: Stanimir Varbanov , Mauro Carvalho Chehab , Dmitry Baryshkov , , , , Vikash Garodia , X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1732770318; l=1564; i=quic_vgarodia@quicinc.com; s=20241104; h=from:subject:message-id; bh=momNFG7HmrlvZT1BkDBQhwhSFM+A1S+Ius0MDXLSgYE=; b=o3cddvPifdHMpz/sY3bPYGoPg1oAz/6fk1tbBC4Vk5DnMT1IVGki7QvwC8D1vPBQX5TEreMRK 7UdlnLeqj74AcEz/1jwwc2/AQTQpK0xSwnHYAWAFdLlc7+D8z03DSCc X-Developer-Key: i=quic_vgarodia@quicinc.com; a=ed25519; pk=LY9Eqp4KiHWxzGNKGHbwRFEJOfRCSzG/rxQNmvZvaKE= X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nasanex01a.na.qualcomm.com (10.52.223.231) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-GUID: bWmMskfo2w9Z3UX6TvkjcIl4Ygu_Qvje X-Proofpoint-ORIG-GUID: bWmMskfo2w9Z3UX6TvkjcIl4Ygu_Qvje X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.60.29 definitions=2024-09-06_09,2024-09-06_01,2024-09-02_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1011 adultscore=0 lowpriorityscore=0 impostorscore=0 bulkscore=0 mlxscore=0 malwarescore=0 priorityscore=1501 spamscore=0 mlxlogscore=968 phishscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2411120000 definitions=main-2411280039 sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases. Cc: stable@vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue Signed-off-by: Vikash Garodia --- drivers/media/platform/qcom/venus/hfi_venus.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index 6b615270c5dae470c6fad408c9b5bc037883e56e..c3113420d266e61fcab44688580288d7408b50f4 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -1041,18 +1041,23 @@ static void venus_sfr_print(struct venus_hfi_device *hdev) { struct device *dev = hdev->core->dev; struct hfi_sfr *sfr = hdev->sfr.kva; + u32 size; void *p; if (!sfr) return; - p = memchr(sfr->data, '\0', sfr->buf_size); + size = sfr->buf_size; + if (size > ALIGNED_SFR_SIZE) + size = ALIGNED_SFR_SIZE; + + p = memchr(sfr->data, '\0', size); /* * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates * that Venus is in the process of crashing. */ if (!p) - sfr->data[sfr->buf_size - 1] = '\0'; + sfr->data[size - 1] = '\0'; dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); }