| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <a01d1f15542917f0dbc8273bc5bcb41652338841.camel@collabora.com>
Date: Mon, 24 Jul 2023 10:58:21 -0400
From: Nicolas Dufresne <nicolas.dufresne@...labora.com>
To: Yunfei Dong <yunfei.dong@...iatek.com>,
Nícolas "F . R . A . Prado"
<nfraprado@...labora.com>, Hans Verkuil <hverkuil-cisco@...all.nl>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@...labora.com>,
Benjamin Gaignard <benjamin.gaignard@...labora.com>,
Nathan Hebert <nhebert@...omium.org>
Cc: Chen-Yu Tsai <wenst@...omium.org>,
Hsin-Yi Wang <hsinyi@...omium.org>,
Fritz Koenig <frkoenig@...omium.org>,
Daniel Vetter <daniel@...ll.ch>,
Steve Cho <stevecho@...omium.org>, linux-media@...r.kernel.org,
devicetree@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org,
linux-mediatek@...ts.infradead.org,
Project_Global_Chrome_Upstream_Group@...iatek.com
Subject: Re: [PATCH v2,1/2] media: mediatek: vcodec: checking decoder ack
message parameter
Hi Yunfei,
Le samedi 22 juillet 2023 à 15:46 +0800, Yunfei Dong a écrit :
> Need to checking all parameters of msg data are valid or not,
> in case of access null pointer or unreasonable value leading
> to kernel reboot.
May I suggest an alternative commit message ? It would look like:
media: mediatek: vcodec: Fix possible invalid memory access
Validate that the context pointer and the vpu instance within this
context is valid. <please add why it may occur here>
I cannot really provide a full message here, but my understanding is that it is
normal behaviour for the IRQ handler to be called after the context or the VPU
instance has been released ? It is unlikely a great programming pattern though,
can't you remove the handler on time instead ?
Nicolas
>
> Signed-off-by: Yunfei Dong <yunfei.dong@...iatek.com>
> Reviewed-by: Nicolas Dufresne <nicolas.dufresne@...labora.com>
> ---
> .../vcodec/decoder/mtk_vcodec_dec_drv.h | 2 +
> .../mediatek/vcodec/decoder/vdec_vpu_if.c | 77 ++++++++++++-------
> 2 files changed, 52 insertions(+), 27 deletions(-)
>
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
> index 6c318de25a55..7e36b2c69b7d 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h
> @@ -161,6 +161,7 @@ struct mtk_vcodec_dec_pdata {
> * @hw_id: hardware index used to identify different hardware.
> *
> * @msg_queue: msg queue used to store lat buffer information.
> + * @vpu_inst: vpu instance pointer.
> *
> * @is_10bit_bitstream: set to true if it's 10bit bitstream
> */
> @@ -205,6 +206,7 @@ struct mtk_vcodec_dec_ctx {
> int hw_id;
>
> struct vdec_msg_queue msg_queue;
> + void *vpu_inst;
>
> bool is_10bit_bitstream;
> };
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
> index 82c3dc8c4127..23cfe5c6c90b 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c
> @@ -72,6 +72,21 @@ static void handle_get_param_msg_ack(const struct vdec_vpu_ipi_get_param_ack *ms
> }
> }
>
> +static bool vpu_dec_check_ap_inst(struct mtk_vcodec_dec_dev *dec_dev, struct vdec_vpu_inst *vpu)
> +{
> + struct mtk_vcodec_dec_ctx *ctx;
> + int ret = false;
> +
> + list_for_each_entry(ctx, &dec_dev->ctx_list, list) {
> + if (!IS_ERR_OR_NULL(ctx) && ctx->vpu_inst == vpu) {
> + ret = true;
> + break;
> + }
> + }
> +
> + return ret;
> +}
> +
> /*
> * vpu_dec_ipi_handler - Handler for VPU ipi message.
> *
> @@ -84,44 +99,51 @@ static void handle_get_param_msg_ack(const struct vdec_vpu_ipi_get_param_ack *ms
> */
> static void vpu_dec_ipi_handler(void *data, unsigned int len, void *priv)
> {
> + struct mtk_vcodec_dec_dev *dec_dev;
> const struct vdec_vpu_ipi_ack *msg = data;
> - struct vdec_vpu_inst *vpu = (struct vdec_vpu_inst *)
> - (unsigned long)msg->ap_inst_addr;
> + struct vdec_vpu_inst *vpu;
>
> - if (!vpu) {
> + dec_dev = (struct mtk_vcodec_dec_dev *)priv;
> + vpu = (struct vdec_vpu_inst *)(unsigned long)msg->ap_inst_addr;
> + if (!priv || !vpu) {
> mtk_v4l2_vdec_err(vpu->ctx, "ap_inst_addr is NULL, did the SCP hang or crash?");
> return;
> }
>
> - mtk_vdec_debug(vpu->ctx, "+ id=%X", msg->msg_id);
> + if (!vpu_dec_check_ap_inst(dec_dev, vpu) || msg->msg_id < VPU_IPIMSG_DEC_INIT_ACK ||
> + msg->msg_id > VPU_IPIMSG_DEC_GET_PARAM_ACK) {
> + mtk_v4l2_vdec_err(vpu->ctx, "vdec msg id not correctly => 0x%x", msg->msg_id);
> + vpu->failure = -EINVAL;
> + goto error;
> + }
>
> vpu->failure = msg->status;
> - vpu->signaled = 1;
> + if (msg->status != 0)
> + goto error;
>
> - if (msg->status == 0) {
> - switch (msg->msg_id) {
> - case VPU_IPIMSG_DEC_INIT_ACK:
> - handle_init_ack_msg(data);
> - break;
> + switch (msg->msg_id) {
> + case VPU_IPIMSG_DEC_INIT_ACK:
> + handle_init_ack_msg(data);
> + break;
>
> - case VPU_IPIMSG_DEC_START_ACK:
> - case VPU_IPIMSG_DEC_END_ACK:
> - case VPU_IPIMSG_DEC_DEINIT_ACK:
> - case VPU_IPIMSG_DEC_RESET_ACK:
> - case VPU_IPIMSG_DEC_CORE_ACK:
> - case VPU_IPIMSG_DEC_CORE_END_ACK:
> - break;
> + case VPU_IPIMSG_DEC_START_ACK:
> + case VPU_IPIMSG_DEC_END_ACK:
> + case VPU_IPIMSG_DEC_DEINIT_ACK:
> + case VPU_IPIMSG_DEC_RESET_ACK:
> + case VPU_IPIMSG_DEC_CORE_ACK:
> + case VPU_IPIMSG_DEC_CORE_END_ACK:
> + break;
>
> - case VPU_IPIMSG_DEC_GET_PARAM_ACK:
> - handle_get_param_msg_ack(data);
> - break;
> - default:
> - mtk_vdec_err(vpu->ctx, "invalid msg=%X", msg->msg_id);
> - break;
> - }
> + case VPU_IPIMSG_DEC_GET_PARAM_ACK:
> + handle_get_param_msg_ack(data);
> + break;
> + default:
> + mtk_vdec_err(vpu->ctx, "invalid msg=%X", msg->msg_id);
> + break;
> }
>
> - mtk_vdec_debug(vpu->ctx, "- id=%X", msg->msg_id);
> +error:
> + vpu->signaled = 1;
> }
>
> static int vcodec_vpu_send_msg(struct vdec_vpu_inst *vpu, void *msg, int len)
> @@ -182,9 +204,10 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu)
>
> init_waitqueue_head(&vpu->wq);
> vpu->handler = vpu_dec_ipi_handler;
> + vpu->ctx->vpu_inst = vpu;
>
> err = mtk_vcodec_fw_ipi_register(vpu->ctx->dev->fw_handler, vpu->id,
> - vpu->handler, "vdec", NULL);
> + vpu->handler, "vdec", vpu->ctx->dev);
> if (err) {
> mtk_vdec_err(vpu->ctx, "vpu_ipi_register fail status=%d", err);
> return err;
> @@ -193,7 +216,7 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu)
> if (vpu->ctx->dev->vdec_pdata->hw_arch == MTK_VDEC_LAT_SINGLE_CORE) {
> err = mtk_vcodec_fw_ipi_register(vpu->ctx->dev->fw_handler,
> vpu->core_id, vpu->handler,
> - "vdec", NULL);
> + "vdec", vpu->ctx->dev);
> if (err) {
> mtk_vdec_err(vpu->ctx, "vpu_ipi_register core fail status=%d", err);
> return err;
Powered by blists - more mailing lists