A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 14:19:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "msm: kgsl: Fix out of bound write in adreno_profile_submit_time"

Browse source
This commit is contained in:
qctecmdr 2021-09-24 05:19:02 -07:00 • committed by Gerrit - the friendly Code Review server
commit d54b4c3701
1 changed files with 10 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

33
drivers/gpu/msm/kgsl_drawobj.c
View file

@ -715,6 +715,7 @@ static void add_profiling_buffer(struct kgsl_device *device,
{
struct kgsl_mem_entry *entry;
struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
u64 start;
if (!(drawobj->flags & KGSL_DRAWOBJ_PROFILING))
return;
@ -731,7 +732,14 @@ static void add_profiling_buffer(struct kgsl_device *device,
gpuaddr);
if (entry != NULL) {
if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size)) {
start = id ? (entry->memdesc.gpuaddr + offset) : gpuaddr;
/*
* Make sure there is enough room in the object to store the
* entire profiling buffer object
*/
if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size) ||
!kgsl_gpuaddr_in_memdesc(&entry->memdesc, start,
sizeof(struct kgsl_drawobj_profiling_buffer))) {
kgsl_mem_entry_put(entry);
entry = NULL;
}
@ -744,28 +752,7 @@ static void add_profiling_buffer(struct kgsl_device *device,
return;
}
if (!id) {
cmdobj->profiling_buffer_gpuaddr = gpuaddr;
} else {
u64 off = offset + sizeof(struct kgsl_drawobj_profiling_buffer);
/*
* Make sure there is enough room in the object to store the
* entire profiling buffer object
*/
if (off < offset || off >= entry->memdesc.size) {
dev_err(device->dev,
"ignore invalid profile offset ctxt %d id %d offset %lld gpuaddr %llx size %lld\n",
drawobj->context->id, id, offset, gpuaddr, size);
kgsl_mem_entry_put(entry);
return;
}
cmdobj->profiling_buffer_gpuaddr =
entry->memdesc.gpuaddr + offset;
}
cmdobj->profiling_buffer_gpuaddr = start;
cmdobj->profiling_buf_entry = entry;
}