Received: by 2002:a05:6358:51dd:b0:131:369:b2a3 with SMTP id 29csp1075320rwl; Thu, 10 Aug 2023 06:12:14 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHgcaSMn052WztrSy0YYzQhDAU/iVZ8MxY/N6H9MU+lEFH0rsrog79XYdKVcsxx+vcIJB6d X-Received: by 2002:a05:6e02:104b:b0:349:9956:e22b with SMTP id p11-20020a056e02104b00b003499956e22bmr137885ilj.20.1691673134048; Thu, 10 Aug 2023 06:12:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1691673134; cv=none; d=google.com; s=arc-20160816; b=v/qTK9YJ/v3p39/Qm5MDdtL4FVNtQR93qrqFfgjgWC9ekfqTLgIZ/feZ2gb1tx0Qbe XEWwmokdpEnrNTi7xTWqdMDTKRc70CIYpdv7eAeBJ1bRh4cXKoN46K7aVgGu31XUogq2 xi/ikmG6wH/1q5Voo7vhJFeaBCJcOJNs0sZP3Lclr7qSd7jaJu9VA8CRVjKeWqK0Ripz 7LBaqjF4lszPETwa2OUSmGy7TDpicRqnn6Wmg0jSKg0Cs6PLhzayGoOS3ad6brmLNtF6 XuiDrMvQV03r0n5t8Y8+szkN4RVNNQD69awoDKkK73NRjuQBKUQUzV71FIrhFVx9kkGN uicg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:in-reply-to:from :references:cc:to:content-language:subject:user-agent:mime-version :date:message-id:dkim-signature; bh=0tTnJRznSRZRdOph0O6zcCrYZpGpbt3RxvxZjdVmHkE=; fh=U78sclg0Y4Gxw/OVnaUghVFQGh/K/BlwQoZ5+9IUuFc=; b=usPWt7jeDYwGcQ8AcKNC0fcMyOVq5hGU0OAoII9kbpHhOLK2HyE6slz8WFHWUmD0+N vd+rKhB4LKM1iqLKGQTUISySI81DcV49/VCAY8X91mc9vEjmHPMp6FiNXyJmUfSYg754 n1bgu+xEdjvUdtbcIW/BlF+d0QF9v6/39YD7E+XZDnLbfgWwZ1E6sJLbXqeC99s9TJ4s g0qkUn1u0rYN3d4VMwOvd4qOmrDyt8FJipjeI2WaEP/IXwWUAoLRrhGrMek/MZCGpSoG zB9dEAXscvkNx9b2SR5oJV09pjGq5F9WriQFNji/Y7w1f4QM7IovUwi8MPWmfaQmfoOi XJKA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fKJ+XgKf; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id j21-20020a633c15000000b00564fda17df8si1466911pga.276.2023.08.10.06.12.00; Thu, 10 Aug 2023 06:12:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fKJ+XgKf; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234544AbjHJL02 (ORCPT + 99 others); Thu, 10 Aug 2023 07:26:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53992 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234400AbjHJL01 (ORCPT ); Thu, 10 Aug 2023 07:26:27 -0400 Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com [IPv6:2a00:1450:4864:20::32d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8020C2684 for ; Thu, 10 Aug 2023 04:26:26 -0700 (PDT) Received: by mail-wm1-x32d.google.com with SMTP id 5b1f17b1804b1-3fe4b95c371so4409585e9.1 for ; Thu, 10 Aug 2023 04:26:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1691666785; x=1692271585; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=0tTnJRznSRZRdOph0O6zcCrYZpGpbt3RxvxZjdVmHkE=; b=fKJ+XgKfS6t6OZDf5M7jPUsCyW9CxjMy/rf5IpsMyVGixbslL5/c8+CUJ+pDk7tHoa V/JUS2s0qjrb8TP01tAcL0IcZ8nIuK0TX3bIQ4J6vUorWnmDmJDtpOR6R8JQSNFzDZlY LOYoRSc3UzkxNvrE4Sebp/Frl0mAnRt4+H5sX1rsq/Lx1iMtyq9MakfrVXzpxSOnzjUH PaeH7rWr9u4HkiJdSbkqvoCKE4IArcLZU6ef/2qZVCpIj4e7Spx4VTAmVcIswwyLIyrS ZMRjj5yg3V4yGMTXu4mys6kQi65osuj0z7DD+ZvJkDiStuGoigYzxgr4n7zmr8qu0pmR 2m7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691666785; x=1692271585; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=0tTnJRznSRZRdOph0O6zcCrYZpGpbt3RxvxZjdVmHkE=; b=KGEU+WX+fo7ueMRVYhECRRW2zTQuPzIgwOOljr69+CbLbAFQ7F+/goJvgcPlnWMObK 4lavXRCYvP3YvywIRZXIdpoCqKQzGuNXnsLb9AffbsBd1lgFIJ7j08MK15/L939qHW0G Dos0mku9MpO2xDgC+PUP7r2MuNABiB62DK41mhwGjYvfo09A4uLC2PBWWcyVz2anh+Ce 475hP53N1qku0KXWPTXCysEocmsXEkw7JjUDJiz6tCKENaunEs1cC41lmhsS4PP7wIjZ Ymo5evLHuF8jIKi2tQl1kFmbsdyaSMlAZ39WhM1L/7Fy8DHD3IDH6N+OhKcad8JviqgM XUCQ== X-Gm-Message-State: AOJu0YzyoeG/1wSTa2Q74K3og0X7UlX4YjyBxWkqhBnIGgfwSrp7rq0o C7Dp2+ug8v9p12ERxnXmMVIiWA== X-Received: by 2002:a05:600c:a3a1:b0:3fb:b18a:f32d with SMTP id hn33-20020a05600ca3a100b003fbb18af32dmr1453763wmb.17.1691666785048; Thu, 10 Aug 2023 04:26:25 -0700 (PDT) Received: from [192.168.0.162] (188-141-3-169.dynamic.upc.ie. [188.141.3.169]) by smtp.gmail.com with ESMTPSA id o13-20020a05600c378d00b003fe2de3f94fsm1839494wmr.12.2023.08.10.04.26.23 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 10 Aug 2023 04:26:24 -0700 (PDT) Message-ID: Date: Thu, 10 Aug 2023 12:26:23 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.8.0 Subject: Re: [PATCH v2 2/4] venus: hfi: fix the check to handle session buffer requirement Content-Language: en-US To: Vikash Garodia , stanimir.k.varbanov@gmail.com, agross@kernel.org, andersson@kernel.org, konrad.dybcio@linaro.org, mchehab@kernel.org, hans.verkuil@cisco.com, tfiga@chromium.org Cc: linux-media@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <1691634304-2158-1-git-send-email-quic_vgarodia@quicinc.com> <1691634304-2158-3-git-send-email-quic_vgarodia@quicinc.com> From: Bryan O'Donoghue In-Reply-To: <1691634304-2158-3-git-send-email-quic_vgarodia@quicinc.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-4.3 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/08/2023 03:25, Vikash Garodia wrote: > Buffer requirement, for different buffer type, comes from video firmware. > While copying these requirements, there is an OOB possibility when the > payload from firmware is more than expected size. Fix the check to avoid > the OOB possibility. > > Cc: stable@vger.kernel.org > Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") > Reviewed-by: Nathan Hebert > Signed-off-by: Vikash Garodia > --- > drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c > index 3d5dadf..3e85bd8 100644 > --- a/drivers/media/platform/qcom/venus/hfi_msgs.c > +++ b/drivers/media/platform/qcom/venus/hfi_msgs.c > @@ -398,7 +398,7 @@ session_get_prop_buf_req(struct hfi_msg_session_property_info_pkt *pkt, > memcpy(&bufreq[idx], buf_req, sizeof(*bufreq)); > idx++; > > - if (idx > HFI_BUFFER_TYPE_MAX) > + if (idx >= HFI_BUFFER_TYPE_MAX) > return HFI_ERR_SESSION_INVALID_PARAMETER; > > req_bytes -= sizeof(struct hfi_buffer_requirements); Reviewed-by: Bryan O'Donoghue