A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: cvp: Avoid overflowing the stack frame

Browse source 
Building with llvm generates the following warning:

  drivers/media/platform/msm/cvp//msm_cvp_ioctl.c:611:13: warning: stack frame
  size of 2064 bytes in function 'cvp_ioctl' [-Wframe-larger-than=]

struct cvp_kmd_hfi_packet is 1880 bytes and is a member of a union inside
struct cvp_kmd_arg which eventually triggers the warning. Allocate the
struct from the heap instead.

Fixes: ffe925cbca ("msm: cvp: Port CVP driver to 5.x kernel")
Change-Id: Ic0dedbad82d36b7faade85c3428b1013b527b576
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
This commit is contained in:
Jordan Crouse 2019-12-16 12:27:51 -07:00
commit e9594a695d
1 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
drivers/media/platform/msm/cvp/msm_cvp_ioctl.c
View file

@ -526,34 +526,40 @@ static long cvp_ioctl(struct msm_cvp_inst *inst,
unsigned int cmd, unsigned long arg)
{
int rc;
struct cvp_kmd_arg karg;
struct cvp_kmd_arg *karg;
if (!inst) {
dprintk(CVP_ERR, "%s: invalid params\n", __func__);
return -EINVAL;
}
memset(&karg, 0, sizeof(struct cvp_kmd_arg));
karg = kzalloc(sizeof(*karg), GFP_KERNEL);
if (!karg)
return -ENOMEM;
if (convert_from_user(&karg, arg, inst)) {
if (convert_from_user(karg, arg, inst)) {
dprintk(CVP_ERR, "%s: failed to get from user cmd %x\n",
__func__, karg.type);
__func__, karg->type);
kfree(karg);
return -EFAULT;
}
rc = msm_cvp_private((void *)inst, cmd, &karg);
rc = msm_cvp_private((void *)inst, cmd, karg);
if (rc) {
dprintk(CVP_ERR, "%s: failed cmd type %x %d\n",
__func__, karg.type, rc);
__func__, karg->type, rc);
kfree(karg);
return rc;
}
if (convert_to_user(&karg, arg)) {
if (convert_to_user(karg, arg)) {
dprintk(CVP_ERR, "%s: failed to copy to user cmd %x\n",
__func__, karg.type);
__func__, karg->type);
kfree(karg);
return -EFAULT;
}
kfree(karg);
return rc;
}