* [PATCH v3][venus-for-next-v5.14] media: venus: hfi_cmds: Fix packet size calculation
@ 2021-06-03 0:17 Gustavo A. R. Silva
2021-06-03 22:15 ` Kees Cook
2021-06-09 21:06 ` Gustavo A. R. Silva
0 siblings, 2 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-06-03 0:17 UTC (permalink / raw)
To: Stanimir Varbanov, Andy Gross, Bjorn Andersson,
Mauro Carvalho Chehab, Gustavo A. R. Silva
Cc: linux-media, linux-arm-msm, linux-kernel, Gustavo A. R. Silva,
linux-hardening, Kees Cook
Now that a one-element array was replaced with a flexible-array member
in struct hfi_sys_set_property_pkt, use the struct_size() helper to
correctly calculate the packet size.
Fixes: 701e10b3fd9f ("media: venus: hfi_cmds.h: Replace one-element array with flexible-array member")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
Changes in v3:
- Fix size calculation in call to struct_size().
Link: https://lore.kernel.org/linux-hardening/202106021254.39A1561075@keescook/
Link: https://lore.kernel.org/linux-hardening/113fd896-464c-6aef-215a-a53ac6103a62@embeddedor.com/
Changes in v2:
- Include linux/overflow.h for struct_size().
drivers/media/platform/qcom/venus/hfi_cmds.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.c b/drivers/media/platform/qcom/venus/hfi_cmds.c
index 4b9dea7f6940..f51024786991 100644
--- a/drivers/media/platform/qcom/venus/hfi_cmds.c
+++ b/drivers/media/platform/qcom/venus/hfi_cmds.c
@@ -3,6 +3,7 @@
* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
* Copyright (C) 2017 Linaro Ltd.
*/
+#include <linux/overflow.h>
#include <linux/errno.h>
#include <linux/hash.h>
@@ -27,7 +28,7 @@ void pkt_sys_idle_indicator(struct hfi_sys_set_property_pkt *pkt, u32 enable)
{
struct hfi_enable *hfi = (struct hfi_enable *)&pkt->data[1];
- pkt->hdr.size = sizeof(*pkt) + sizeof(*hfi) + sizeof(u32);
+ pkt->hdr.size = struct_size(pkt, data, 1) + sizeof(*hfi);
pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
pkt->num_properties = 1;
pkt->data[0] = HFI_PROPERTY_SYS_IDLE_INDICATOR;
@@ -39,7 +40,7 @@ void pkt_sys_debug_config(struct hfi_sys_set_property_pkt *pkt, u32 mode,
{
struct hfi_debug_config *hfi;
- pkt->hdr.size = sizeof(*pkt) + sizeof(*hfi) + sizeof(u32);
+ pkt->hdr.size = struct_size(pkt, data, 1) + sizeof(*hfi);
pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
pkt->num_properties = 1;
pkt->data[0] = HFI_PROPERTY_SYS_DEBUG_CONFIG;
@@ -50,7 +51,7 @@ void pkt_sys_debug_config(struct hfi_sys_set_property_pkt *pkt, u32 mode,
void pkt_sys_coverage_config(struct hfi_sys_set_property_pkt *pkt, u32 mode)
{
- pkt->hdr.size = sizeof(*pkt) + sizeof(u32);
+ pkt->hdr.size = struct_size(pkt, data, 2);
pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
pkt->num_properties = 1;
pkt->data[0] = HFI_PROPERTY_SYS_CONFIG_COVERAGE;
@@ -116,7 +117,7 @@ void pkt_sys_power_control(struct hfi_sys_set_property_pkt *pkt, u32 enable)
{
struct hfi_enable *hfi = (struct hfi_enable *)&pkt->data[1];
- pkt->hdr.size = sizeof(*pkt) + sizeof(*hfi) + sizeof(u32);
+ pkt->hdr.size = struct_size(pkt, data, 1) + sizeof(*hfi);
pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
pkt->num_properties = 1;
pkt->data[0] = HFI_PROPERTY_SYS_CODEC_POWER_PLANE_CTRL;
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v3][venus-for-next-v5.14] media: venus: hfi_cmds: Fix packet size calculation
2021-06-03 0:17 [PATCH v3][venus-for-next-v5.14] media: venus: hfi_cmds: Fix packet size calculation Gustavo A. R. Silva
@ 2021-06-03 22:15 ` Kees Cook
2021-06-09 21:06 ` Gustavo A. R. Silva
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2021-06-03 22:15 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Stanimir Varbanov, Andy Gross, Bjorn Andersson,
Mauro Carvalho Chehab, linux-media, linux-arm-msm, linux-kernel,
linux-hardening
On Wed, Jun 02, 2021 at 07:17:08PM -0500, Gustavo A. R. Silva wrote:
> Now that a one-element array was replaced with a flexible-array member
> in struct hfi_sys_set_property_pkt, use the struct_size() helper to
> correctly calculate the packet size.
>
> Fixes: 701e10b3fd9f ("media: venus: hfi_cmds.h: Replace one-element array with flexible-array member")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks for the update!
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v3][venus-for-next-v5.14] media: venus: hfi_cmds: Fix packet size calculation
2021-06-03 0:17 [PATCH v3][venus-for-next-v5.14] media: venus: hfi_cmds: Fix packet size calculation Gustavo A. R. Silva
2021-06-03 22:15 ` Kees Cook
@ 2021-06-09 21:06 ` Gustavo A. R. Silva
1 sibling, 0 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-06-09 21:06 UTC (permalink / raw)
To: Gustavo A. R. Silva, Stanimir Varbanov, Andy Gross,
Bjorn Andersson, Mauro Carvalho Chehab
Cc: linux-media, linux-arm-msm, linux-kernel, linux-hardening, Kees Cook
Hi all,
Friendly ping: who can take this, please?
Thanks
--
Gustavo
On 6/2/21 19:17, Gustavo A. R. Silva wrote:
> Now that a one-element array was replaced with a flexible-array member
> in struct hfi_sys_set_property_pkt, use the struct_size() helper to
> correctly calculate the packet size.
>
> Fixes: 701e10b3fd9f ("media: venus: hfi_cmds.h: Replace one-element array with flexible-array member")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
> Changes in v3:
> - Fix size calculation in call to struct_size().
> Link: https://lore.kernel.org/linux-hardening/202106021254.39A1561075@keescook/
> Link: https://lore.kernel.org/linux-hardening/113fd896-464c-6aef-215a-a53ac6103a62@embeddedor.com/
>
> Changes in v2:
> - Include linux/overflow.h for struct_size().
>
> drivers/media/platform/qcom/venus/hfi_cmds.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.c b/drivers/media/platform/qcom/venus/hfi_cmds.c
> index 4b9dea7f6940..f51024786991 100644
> --- a/drivers/media/platform/qcom/venus/hfi_cmds.c
> +++ b/drivers/media/platform/qcom/venus/hfi_cmds.c
> @@ -3,6 +3,7 @@
> * Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.
> * Copyright (C) 2017 Linaro Ltd.
> */
> +#include <linux/overflow.h>
> #include <linux/errno.h>
> #include <linux/hash.h>
>
> @@ -27,7 +28,7 @@ void pkt_sys_idle_indicator(struct hfi_sys_set_property_pkt *pkt, u32 enable)
> {
> struct hfi_enable *hfi = (struct hfi_enable *)&pkt->data[1];
>
> - pkt->hdr.size = sizeof(*pkt) + sizeof(*hfi) + sizeof(u32);
> + pkt->hdr.size = struct_size(pkt, data, 1) + sizeof(*hfi);
> pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
> pkt->num_properties = 1;
> pkt->data[0] = HFI_PROPERTY_SYS_IDLE_INDICATOR;
> @@ -39,7 +40,7 @@ void pkt_sys_debug_config(struct hfi_sys_set_property_pkt *pkt, u32 mode,
> {
> struct hfi_debug_config *hfi;
>
> - pkt->hdr.size = sizeof(*pkt) + sizeof(*hfi) + sizeof(u32);
> + pkt->hdr.size = struct_size(pkt, data, 1) + sizeof(*hfi);
> pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
> pkt->num_properties = 1;
> pkt->data[0] = HFI_PROPERTY_SYS_DEBUG_CONFIG;
> @@ -50,7 +51,7 @@ void pkt_sys_debug_config(struct hfi_sys_set_property_pkt *pkt, u32 mode,
>
> void pkt_sys_coverage_config(struct hfi_sys_set_property_pkt *pkt, u32 mode)
> {
> - pkt->hdr.size = sizeof(*pkt) + sizeof(u32);
> + pkt->hdr.size = struct_size(pkt, data, 2);
> pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
> pkt->num_properties = 1;
> pkt->data[0] = HFI_PROPERTY_SYS_CONFIG_COVERAGE;
> @@ -116,7 +117,7 @@ void pkt_sys_power_control(struct hfi_sys_set_property_pkt *pkt, u32 enable)
> {
> struct hfi_enable *hfi = (struct hfi_enable *)&pkt->data[1];
>
> - pkt->hdr.size = sizeof(*pkt) + sizeof(*hfi) + sizeof(u32);
> + pkt->hdr.size = struct_size(pkt, data, 1) + sizeof(*hfi);
> pkt->hdr.pkt_type = HFI_CMD_SYS_SET_PROPERTY;
> pkt->num_properties = 1;
> pkt->data[0] = HFI_PROPERTY_SYS_CODEC_POWER_PLANE_CTRL;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-06-09 21:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-03 0:17 [PATCH v3][venus-for-next-v5.14] media: venus: hfi_cmds: Fix packet size calculation Gustavo A. R. Silva
2021-06-03 22:15 ` Kees Cook
2021-06-09 21:06 ` Gustavo A. R. Silva
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.