From 4ceec18783014d5971602be2eb6f59f83121c565 Mon Sep 17 00:00:00 2001 From: Alexandre Courbot Date: Wed, 23 Jun 2021 18:30:29 +0900 Subject: [PATCH] virtio: video: reject resources with more than one entry The crosvm video device cannot currently work with resources that have more than one memory/object entry. Enforce this rule at the command level. BUG=b:161774071 BUG=b:169295147 TEST=Android Youtube plays properly on Hatch. Cq-Depend: chromium:3247491 Cq-Depend: chromium:3247492 Change-Id: Ibfe2e420b4a77062cca940c5e97e7053aa4b76a7 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3026345 Tested-by: kokoro Commit-Queue: Alexandre Courbot Reviewed-by: Keiichi Watanabe --- devices/src/virtio/video/command.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/devices/src/virtio/video/command.rs b/devices/src/virtio/video/command.rs index 91aa244374..cb4d1cea63 100644 --- a/devices/src/virtio/video/command.rs +++ b/devices/src/virtio/video/command.rs @@ -160,6 +160,7 @@ impl<'a> VideoCmd { planes_layout, num_planes, plane_offsets, + num_entries, .. } = r.read_obj()?; @@ -181,6 +182,12 @@ impl<'a> VideoCmd { ); return Err(InvalidArgument); } + // We only support single-entry objects for now. + if num_planes != 1 || num_entries[0] != 1 { + error!("the number of entries must be equal to 1"); + return Err(InvalidArgument); + } + let plane_offsets = plane_offsets[0..num_planes as usize] .iter() .map(|x| Into::::into(*x))