Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 03196aba authored by Bharath's avatar Bharath
Browse files

Merge tag 'LA.UM.10.6.2.r1-02200-89xx.0' into staging/12/fp3 

"LA.UM.10.6.2.r1-02200-89xx.0"

* tag 'LA.UM.10.6.2.r1-02200-89xx.0':
  msm: kgsl: Fix gpuaddr_in_range() to check upper bound
  msm: kgsl: Remove 'fd' dependency to get dma_buf handle
  msm: adsprpc: Use buf_get before ion apis
  msm: camera: reqmgr: Validate the link handle
  qcom: soc: spcom: Verify channel name null terminator
  msm: vidc: fix msm_comm_get_vidc_buffer fd race issue

Change-Id: Ib30d07b5cf0038020ce3079ae43b8e3696449da7
parents 7c37e65b 9a60ac16

drivers/char/adsprpc.c

+3 −3
Original line number Diff line number Diff line
@@ -917,6 +917,9 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
				(unsigned int)map->attr);

			map->refs = 2;

		}

		VERIFY(err, !IS_ERR_OR_NULL(map->buf = dma_buf_get(fd)));

		if (err)

			goto bail;

		VERIFY(err, !IS_ERR_OR_NULL(map->handle =

				ion_import_dma_buf_fd(fl->apps->client, fd)));

		if (err)
@@ -947,9 +950,6 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
		if (map->attr & FASTRPC_ATTR_NOVA && !sess->smmu.coherent)

			map->uncached = 1;



		VERIFY(err, !IS_ERR_OR_NULL(map->buf = dma_buf_get(fd)));

		if (err)

			goto bail;

		VERIFY(err, !IS_ERR_OR_NULL(map->attach =

				dma_buf_attach(map->buf, sess->smmu.dev)));

		if (err)

drivers/gpu/msm/adreno_dispatch.c

+2 −1
Original line number Diff line number Diff line
@@ -1155,7 +1155,8 @@ static inline bool _verify_ib(struct kgsl_device_private *dev_priv, 
	}



	/* Make sure that the address is mapped */

	if (!kgsl_mmu_gpuaddr_in_range(private->pagetable, ib->gpuaddr)) {

	if (!kgsl_mmu_gpuaddr_in_range(private->pagetable, ib->gpuaddr,

		ib->size)) {

		pr_context(device, context, "ctxt %d invalid ib gpuaddr %llX\n",

			context->id, ib->gpuaddr);

		return false;

drivers/gpu/msm/kgsl.c

+8 −16
Original line number Diff line number Diff line
@@ -1257,7 +1257,7 @@ kgsl_sharedmem_find(struct kgsl_process_private *private, uint64_t gpuaddr) 
	if (!private)

		return NULL;



	if (!kgsl_mmu_gpuaddr_in_range(private->pagetable, gpuaddr))

	if (!kgsl_mmu_gpuaddr_in_range(private->pagetable, gpuaddr, 0))

		return NULL;



	spin_lock(&private->mem_lock);
@@ -2243,15 +2243,6 @@ static int kgsl_setup_anon_useraddr(struct kgsl_pagetable *pagetable, 
}



#ifdef CONFIG_DMA_SHARED_BUFFER

static int match_file(const void *p, struct file *file, unsigned int fd)

{

	/*

	 * We must return fd + 1 because iterate_fd stops searching on

	 * non-zero return, but 0 is a valid fd.

	 */

	return (p == file) ? (fd + 1) : 0;

}



static void _setup_cache_mode(struct kgsl_mem_entry *entry,

		struct vm_area_struct *vma)

{
@@ -2289,8 +2280,6 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device, 
	vma = find_vma(current->mm, hostptr);



	if (vma && vma->vm_file) {

		int fd;



		ret = check_vma_flags(vma, entry->memdesc.flags);

		if (ret) {

			up_read(&current->mm->mmap_sem);
@@ -2306,10 +2295,13 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device, 
			return -EFAULT;

		}



		/* Look for the fd that matches this the vma file */

		fd = iterate_fd(current->files, 0, match_file, vma->vm_file);

		if (fd != 0)

			dmabuf = dma_buf_get(fd - 1);

		/*

		 * Take a refcount because dma_buf_put() decrements the

		 * refcount

		 */

		get_file(vma->vm_file);



		dmabuf = vma->vm_file->private_data;

	}



	if (IS_ERR_OR_NULL(dmabuf)) {

drivers/gpu/msm/kgsl_iommu.c

+5 −4
Original line number Diff line number Diff line
@@ -2567,20 +2567,21 @@ static int kgsl_iommu_svm_range(struct kgsl_pagetable *pagetable, 
}



static bool kgsl_iommu_addr_in_range(struct kgsl_pagetable *pagetable,

		uint64_t gpuaddr)

		uint64_t gpuaddr, uint64_t size)

{

	struct kgsl_iommu_pt *pt = pagetable->priv;



	if (gpuaddr == 0)

		return false;



	if (gpuaddr >= pt->va_start && gpuaddr < pt->va_end)

	if (gpuaddr >= pt->va_start && (gpuaddr + size) < pt->va_end)

		return true;



	if (gpuaddr >= pt->compat_va_start && gpuaddr < pt->compat_va_end)

	if (gpuaddr >= pt->compat_va_start &&

			(gpuaddr + size) < pt->compat_va_end)

		return true;



	if (gpuaddr >= pt->svm_start && gpuaddr < pt->svm_end)

	if (gpuaddr >= pt->svm_start && (gpuaddr + size) < pt->svm_end)

		return true;



	return false;

drivers/gpu/msm/kgsl_mmu.c

+4 −3
Original line number Diff line number Diff line
@@ -613,10 +613,11 @@ enum kgsl_mmutype kgsl_mmu_get_mmutype(struct kgsl_device *device) 
EXPORT_SYMBOL(kgsl_mmu_get_mmutype);



bool kgsl_mmu_gpuaddr_in_range(struct kgsl_pagetable *pagetable,

		uint64_t gpuaddr)

		uint64_t gpuaddr, uint64_t size)

{

	if (PT_OP_VALID(pagetable, addr_in_range))

		return pagetable->pt_ops->addr_in_range(pagetable, gpuaddr);

		return pagetable->pt_ops->addr_in_range(pagetable,

			 gpuaddr, size);



	return false;

}
@@ -652,7 +653,7 @@ EXPORT_SYMBOL(kgsl_mmu_get_qtimer_global_entry); 
 */



static bool nommu_gpuaddr_in_range(struct kgsl_pagetable *pagetable,

		uint64_t gpuaddr)

		uint64_t gpuaddr, uint64_t size)

{

	return (gpuaddr != 0) ? true : false;

}