| Message ID | 20250215-venus-security-fixes-v2-0-cfc7e4b87168@quicinc.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | venus driver fixes to avoid possible OOB read access | expand |
On 15/02/2025 17:19, Vedang Nagar wrote: > This series primarily adds check at relevant places in venus driver > where there are possible OOB accesses due to unexpected payload > from venus firmware. The patches describes the specific OOB possibility. > > Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com> > --- > Changes in v2: > - Decompose sequence change event function. > - Fix repopulating the packet .with the first read during read_queue. > - Link to v1: https://lore.kernel.org/r/20250104-venus-security-fixes-v1-0-9d0dd4594cb4@quicinc.com > > --- > Vedang Nagar (2): > media: venus: fix OOB read issue due to double read > media: venus: fix OOB access issue while reading sequence changed events > > drivers/media/platform/qcom/venus/hfi_msgs.c | 72 +++++++++++++++++++++++---- > drivers/media/platform/qcom/venus/hfi_venus.c | 1 + > 2 files changed, 63 insertions(+), 10 deletions(-) > --- > base-commit: 91e71d606356e50f238d7a87aacdee4abc427f07 > change-id: 20241211-venus-security-fixes-50c22e2564d5 > > Best regards, Could you please address the feedback I gave you / questions posited in these two messages ? 4cfc1fe1-2fab-4256-9ce2-b4a0aad1069e@linaro.org 0eab7323-ce86-40c7-9737-06eedcdf492d@linaro.org The basic question : what is the lifetime of the data from RX interrupt to consumption by another system agent, DSP, userspace, whatever ? Why is it in this small specific window that the data can change but not later ? What is the mechanism the data can change and how do the changes you propose here address the data lifetime problem ? Without that context, I don't believe it is really possible to validate an additional memcpy() here and there in the code as fixing anything. --- bod
This series primarily adds check at relevant places in venus driver where there are possible OOB accesses due to unexpected payload from venus firmware. The patches describes the specific OOB possibility. Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com> --- Changes in v2: - Decompose sequence change event function. - Fix repopulating the packet .with the first read during read_queue. - Link to v1: https://lore.kernel.org/r/20250104-venus-security-fixes-v1-0-9d0dd4594cb4@quicinc.com --- Vedang Nagar (2): media: venus: fix OOB read issue due to double read media: venus: fix OOB access issue while reading sequence changed events drivers/media/platform/qcom/venus/hfi_msgs.c | 72 +++++++++++++++++++++++---- drivers/media/platform/qcom/venus/hfi_venus.c | 1 + 2 files changed, 63 insertions(+), 10 deletions(-) --- base-commit: 91e71d606356e50f238d7a87aacdee4abc427f07 change-id: 20241211-venus-security-fixes-50c22e2564d5 Best regards,