]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
media: mtk-vpu: avoid unaligned access to DTCM buffer.
authorHsin-Yi Wang <hsinyi@chromium.org>
Wed, 4 Mar 2020 02:58:51 +0000 (03:58 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 Apr 2020 14:11:56 +0000 (16:11 +0200)
commit47886aacd66e47932f7476fda3e21c2659175746
treef1b731d2e49d0b4de06066823d4df6bb52c3ac0e
parent8639697313ffe9108cbe8ce79527d7a001896029
media: mtk-vpu: avoid unaligned access to DTCM buffer.

[ Upstream commit e6599adfad30c340d06574e49a86afa7015c5c60 ]

Previously, vpu->recv_buf and send_buf are forced cast from
void __iomem *tcm. vpu->recv_buf->share_buf is passed to
vpu_ipi_desc.handler(). It's not able to do unaligned access. Otherwise
kernel would crash due to unable to handle kernel paging request.

struct vpu_run {
u32 signaled;
char fw_ver[VPU_FW_VER_LEN];
unsigned int dec_capability;
unsigned int enc_capability;
wait_queue_head_t wq;
};

fw_ver starts at 4 byte boundary. If system enables
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, strscpy() will do
read_word_at_a_time(), which tries to read 8-byte: *(unsigned long *)addr

vpu_init_ipi_handler() calls strscpy(), which would lead to crash.

vpu_init_ipi_handler() and several other handlers (eg.
vpu_dec_ipi_handler) only do read access to this data, so they can be
const, and we can use memcpy_fromio() to copy the buf to another non iomem
buffer then pass to handler.

Fixes: 85709cbf1524 ("media: replace strncpy() by strscpy()")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c
drivers/media/platform/mtk-vcodec/vdec_vpu_if.c
drivers/media/platform/mtk-vcodec/venc_vpu_if.c
drivers/media/platform/mtk-vpu/mtk_vpu.c
drivers/media/platform/mtk-vpu/mtk_vpu.h