Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d448ef7 authored by Kamal Agrawal's avatar Kamal Agrawal Committed by Karsten Tausche
Browse files

msm: kgsl: Fix out of bound write in adreno_profile_submit_time 



Make sure there is enough room in the memory descriptor to store the
entire profiling buffer object.

Change-Id: I1e1c73097bb2bba9645b0a3c66fdbbc71d8ba8fa
Signed-off-by: default avatarKamal Agrawal <kamaagra@codeaurora.org>
Issue: FP3SEC-281
(cherry picked from commit 056794d4)
parent 7b35b2c9

drivers/gpu/msm/kgsl_drawobj.c

+11 −24
Original line number Diff line number Diff line 
/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.

/* Copyright (c) 2016-2019,2021, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -569,6 +569,7 @@ static void add_profiling_buffer(struct kgsl_device *device, 
{

	struct kgsl_mem_entry *entry;

	struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);

	u64 start;



	if (!(drawobj->flags & KGSL_DRAWOBJ_PROFILING))

		return;
@@ -585,7 +586,14 @@ static void add_profiling_buffer(struct kgsl_device *device, 
			gpuaddr);



	if (entry != NULL) {

		if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size)) {

		start = id ? (entry->memdesc.gpuaddr + offset) : gpuaddr;

		/*

		 * Make sure there is enough room in the object to store the

		 * entire profiling buffer object

		 */

		if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size) ||

			!kgsl_gpuaddr_in_memdesc(&entry->memdesc, start,

				sizeof(struct kgsl_drawobj_profiling_buffer))) {

			kgsl_mem_entry_put(entry);

			entry = NULL;

		}
@@ -598,28 +606,7 @@ static void add_profiling_buffer(struct kgsl_device *device, 
		return;

	}





	if (!id) {

		cmdobj->profiling_buffer_gpuaddr = gpuaddr;

	} else {

		u64 off = offset + sizeof(struct kgsl_drawobj_profiling_buffer);



		/*

		 * Make sure there is enough room in the object to store the

		 * entire profiling buffer object

		 */

		if (off < offset || off >= entry->memdesc.size) {

			dev_err(device->dev,

				"ignore invalid profile offset ctxt %d id %d offset %lld gpuaddr %llx size %lld\n",

			drawobj->context->id, id, offset, gpuaddr, size);

			kgsl_mem_entry_put(entry);

			return;

		}



		cmdobj->profiling_buffer_gpuaddr =

			entry->memdesc.gpuaddr + offset;

	}



	cmdobj->profiling_buffer_gpuaddr = start;

	cmdobj->profiling_buf_entry = entry;

}