Evolution-X-Devices/kernel_nothing_sm7325
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FROMGIT: media: venus: hfi_parser: refactor hfi packet parsing logic

Browse Source 
words_count denotes the number of words in total payload, while data
points to payload of various property within it. When words_count
reaches last word, data can access memory beyond the total payload. This
can lead to OOB access. With this patch, the utility api for handling
individual properties now returns the size of data consumed. Accordingly
remaining bytes are calculated before parsing the payload, thereby
eliminates the OOB access possibilities.

Cc: stable@vger.kernel.org
Fixes: 1a73374a04 ("media: venus: hfi_parser: add common capability parser")
CRs-Fixed: 3935669
Change-Id: I692e4a8dea110f0650fe26e07207408087a4d19b
Git-commit: 9edaaa8e3e15aab1ca413ab50556de1975bcb329
Git-repo: https://gitlab.freedesktop.org/linux-media/media-committers.git
Signed-off-by: Vikash Garodia <quic_vgarodia@quicinc.com>
(cherry picked from commit fd9b658c8ab9faa6fbb96004ad4a853c9b30236f)
This commit is contained in:
Vikash Garodia
2025-03-13 14:09:16 +05:30
committed by Vivekananda T
parent 4a29de385e
commit 63b1d96ea8
1 changed files with 73 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
drivers/media/platform/qcom/venus/hfi_parser.c
View File

@@ -62,7 +62,7 @@ fill_buf_mode(struct venus_caps *cap, const void *data, unsigned int num)
cap->cap_bufs_mode_dynamic = true;
}
static void
static int
parse_alloc_mode(struct venus_core *core, u32 codecs, u32 domain, void *data)
{
struct hfi_buffer_alloc_mode_supported *mode = data;
@@ -70,7 +70,7 @@ parse_alloc_mode(struct venus_core *core, u32 codecs, u32 domain, void *data)
u32 *type;
if (num_entries > MAX_ALLOC_MODE_ENTRIES)
return;
return -EINVAL;
type = mode->data;
@@ -82,6 +82,8 @@ parse_alloc_mode(struct venus_core *core, u32 codecs, u32 domain, void *data)
type++;
}
return sizeof(*mode);
}
static void fill_profile_level(struct venus_caps *cap, const void *data,
@@ -96,7 +98,7 @@ static void fill_profile_level(struct venus_caps *cap, const void *data,
cap->num_pl += num;
}
static void
static int
parse_profile_level(struct venus_core *core, u32 codecs, u32 domain, void *data)
{
struct hfi_profile_level_supported *pl = data;
@@ -104,12 +106,14 @@ parse_profile_level(struct venus_core *core, u32 codecs, u32 domain, void *data)
struct hfi_profile_level pl_arr[HFI_MAX_PROFILE_COUNT] = {};
if (pl->profile_count > HFI_MAX_PROFILE_COUNT)
return;
return -EINVAL;
memcpy(pl_arr, proflevel, pl->profile_count * sizeof(*proflevel));
for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
fill_profile_level, pl_arr, pl->profile_count);
return pl->profile_count * sizeof(*proflevel) + sizeof(u32);
}
static void
@@ -124,7 +128,7 @@ fill_caps(struct venus_caps *cap, const void *data, unsigned int num)
cap->num_caps += num;
}
static void
static int
parse_caps(struct venus_core *core, u32 codecs, u32 domain, void *data)
{
struct hfi_capabilities *caps = data;
@@ -133,12 +137,14 @@ parse_caps(struct venus_core *core, u32 codecs, u32 domain, void *data)
struct hfi_capability caps_arr[MAX_CAP_ENTRIES] = {};
if (num_caps > MAX_CAP_ENTRIES)
return;
return -EINVAL;
memcpy(caps_arr, cap, num_caps * sizeof(*cap));
for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
fill_caps, caps_arr, num_caps);
return sizeof(*caps);
}
static void fill_raw_fmts(struct venus_caps *cap, const void *fmts,
@@ -153,7 +159,7 @@ static void fill_raw_fmts(struct venus_caps *cap, const void *fmts,
cap->num_fmts += num_fmts;
}
static void
static int
parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data)
{
struct hfi_uncompressed_format_supported *fmt = data;
@@ -162,7 +168,8 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data)
struct raw_formats rawfmts[MAX_FMT_ENTRIES] = {};
u32 entries = fmt->format_entries;
unsigned int i = 0;
u32 num_planes;
u32 num_planes = 0;
u32 size;
while (entries) {
num_planes = pinfo->num_planes;
@@ -172,7 +179,7 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data)
i++;
if (i >= MAX_FMT_ENTRIES)
return;
return -EINVAL;
if (pinfo->num_planes > MAX_PLANES)
break;
@@ -184,9 +191,13 @@ parse_raw_formats(struct venus_core *core, u32 codecs, u32 domain, void *data)
for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
fill_raw_fmts, rawfmts, i);
size = fmt->format_entries * (sizeof(*constr) * num_planes + 2 * sizeof(u32))
+ 2 * sizeof(u32);
return size;
}
static void parse_codecs(struct venus_core *core, void *data)
static int parse_codecs(struct venus_core *core, void *data)
{
struct hfi_codec_supported *codecs = data;
@@ -198,21 +209,27 @@ static void parse_codecs(struct venus_core *core, void *data)
core->dec_codecs &= ~HFI_VIDEO_CODEC_SPARK;
core->enc_codecs &= ~HFI_VIDEO_CODEC_HEVC;
}
return sizeof(*codecs);
}
static void parse_max_sessions(struct venus_core *core, const void *data)
static int parse_max_sessions(struct venus_core *core, const void *data)
{
const struct hfi_max_sessions_supported *sessions = data;
core->max_sessions_supported = sessions->max_sessions;
return sizeof(*sessions);
}
static void parse_codecs_mask(u32 *codecs, u32 *domain, void *data)
static int parse_codecs_mask(u32 *codecs, u32 *domain, void *data)
{
struct hfi_codec_mask_supported *mask = data;
*codecs = mask->codecs;
*domain = mask->video_domains;
return sizeof(*mask);
}
static void parser_init(struct venus_inst *inst, u32 *codecs, u32 *domain)
@@ -246,46 +263,76 @@ static void parser_fini(struct venus_inst *inst, u32 codecs, u32 domain)
u32 hfi_parser(struct venus_core *core, struct venus_inst *inst, void *buf,
u32 size)
{
unsigned int words_count = size >> 2;
u32 *word = buf, *data, codecs = 0, domain = 0;
u32 *words = buf, *payload, codecs = 0, domain = 0;
u32 *frame_size = buf + size;
u32 rem_bytes = size;
int ret;
if (size % 4)
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
parser_init(inst, &codecs, &domain);
while (words_count) {
data = word + 1;
while (words < frame_size) {
payload = words + 1;
switch (*word) {
switch (*words) {
case HFI_PROPERTY_PARAM_CODEC_SUPPORTED:
parse_codecs(core, data);
if (rem_bytes <= sizeof(struct hfi_codec_supported))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_codecs(core, payload);
if (ret < 0)
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
init_codecs(core);
break;
case HFI_PROPERTY_PARAM_MAX_SESSIONS_SUPPORTED:
parse_max_sessions(core, data);
if (rem_bytes <= sizeof(struct hfi_max_sessions_supported))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_max_sessions(core, payload);
break;
case HFI_PROPERTY_PARAM_CODEC_MASK_SUPPORTED:
parse_codecs_mask(&codecs, &domain, data);
if (rem_bytes <= sizeof(struct hfi_codec_mask_supported))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_codecs_mask(&codecs, &domain, payload);
break;
case HFI_PROPERTY_PARAM_UNCOMPRESSED_FORMAT_SUPPORTED:
parse_raw_formats(core, codecs, domain, data);
if (rem_bytes <= sizeof(struct hfi_uncompressed_format_supported))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_raw_formats(core, codecs, domain, payload);
break;
case HFI_PROPERTY_PARAM_CAPABILITY_SUPPORTED:
parse_caps(core, codecs, domain, data);
if (rem_bytes <= sizeof(struct hfi_capabilities))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_caps(core, codecs, domain, payload);
break;
case HFI_PROPERTY_PARAM_PROFILE_LEVEL_SUPPORTED:
parse_profile_level(core, codecs, domain, data);
if (rem_bytes <= sizeof(struct hfi_profile_level_supported))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_profile_level(core, codecs, domain, payload);
break;
case HFI_PROPERTY_PARAM_BUFFER_ALLOC_MODE_SUPPORTED:
parse_alloc_mode(core, codecs, domain, data);
if (rem_bytes <= sizeof(struct hfi_buffer_alloc_mode_supported))
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
ret = parse_alloc_mode(core, codecs, domain, payload);
break;
default:
ret = sizeof(u32);
break;
}
word++;
words_count--;
if (ret < 0)
return HFI_ERR_SYS_INSUFFICIENT_RESOURCES;
words += ret / sizeof(u32);
rem_bytes -= ret;
}
parser_fini(inst, codecs, domain);