mtk: cmdq: upstream update

1 files changed, 26 insertions, 2 deletions

diff --git a/drivers/misc/mediatek/cmdq/cmdq_driver.c b/drivers/misc/mediatek/cmdq/cmdq_driver.c
index 21512e7e0..4a9d2899f 100644
--- a/drivers/misc/mediatek/cmdq/cmdq_driver.c
+++ b/drivers/misc/mediatek/cmdq/cmdq_driver.c
@@ -41,7 +41,9 @@ static const struct of_device_id cmdq_of_ids[] = {
 };
 #endif
 
-#define CMDQ_MAX_DUMP_REG_COUNT (2048)
+#define CMDQ_MAX_DUMP_REG_COUNT		(2048)
+#define CMDQ_MAX_COMMAND_SIZE		(0x10000)
+#define CMDQ_MAX_WRITE_ADDR_COUNT	(PAGE_SIZE / sizeof(u32))
 
 static dev_t gCmdqDevNo;
 static struct cdev *gCmdqCDev;
@@ -258,7 +260,9 @@ static void cmdq_driver_process_read_address_request(cmdqReadAddressStruct *req_
 	do {
 		if (NULL == req_user ||
 		    0 == req_user->count ||
-		    NULL == CMDQ_U32_PTR(req_user->values) || NULL == CMDQ_U32_PTR(req_user->dmaAddresses)) {
+		    req_user->count > CMDQ_MAX_DUMP_REG_COUNT ||
+		    NULL == CMDQ_U32_PTR(req_user->values) ||
+		    NULL == CMDQ_U32_PTR(req_user->dmaAddresses)) {
 			CMDQ_ERR("[READ_PA] invalid req_user\n");
 			break;
 		}
@@ -385,6 +389,9 @@ static long cmdq_driver_process_command_request(cmdqCommandStruct *pCommand)
 		return -EFAULT;
 	}
 
+	if (pCommand->regRequest.count > CMDQ_MAX_DUMP_REG_COUNT)
+		return -EINVAL;
+
 	/* allocate secure medatata */
 	status = cmdq_driver_create_secure_medadata(pCommand);
 	if (0 != status) {
@@ -479,6 +486,11 @@ static long cmdq_ioctl(struct file *pFile, unsigned int code, unsigned long para
 			return -EFAULT;
 		}
 
+		if (command.regRequest.count > CMDQ_MAX_DUMP_REG_COUNT ||
+			!command.blockSize ||
+			command.blockSize > CMDQ_MAX_COMMAND_SIZE)
+			return -EINVAL;
+
 		/* insert private_data for resource reclaim */
 		command.privateData = CMDQ_U32_PTR(pFile->private_data);
 
@@ -507,6 +519,9 @@ static long cmdq_ioctl(struct file *pFile, unsigned int code, unsigned long para
 			return -EFAULT;
 		}
 
+		if (job.command.blockSize > CMDQ_MAX_COMMAND_SIZE)
+			return -EINVAL;
+
 		/* backup */
 		userRegCount = job.command.regRequest.count;
 
@@ -558,6 +573,8 @@ static long cmdq_ioctl(struct file *pFile, unsigned int code, unsigned long para
 			return -EFAULT;
 		}
 		pTask = (TaskStruct *)(unsigned long)jobResult.hJob;
+		if (pTask->regCount > CMDQ_MAX_DUMP_REG_COUNT)
+			return -EINVAL;
 
 		/* utility service, fill the engine flag. */
 		/* this is required by MDP. */
@@ -653,6 +670,13 @@ static long cmdq_ioctl(struct file *pFile, unsigned int code, unsigned long para
 				return -EFAULT;
 			}
 
+			if (!addrReq.count || addrReq.count > CMDQ_MAX_WRITE_ADDR_COUNT) {
+				CMDQ_ERR(
+					"CMDQ_IOCTL_ALLOC_WRITE_ADDRESS invalid alloc write addr count:%u\n",
+					addrReq.count);
+				return -EINVAL;
+			}
+
 			status = cmdqCoreAllocWriteAddress(addrReq.count, &paStart);
 			if (0 != status) {
 				CMDQ_ERR