Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69355b8e authored by Carter Cooper's avatar Carter Cooper
Browse files

msm: kgsl: Properly remove ref count on gpuobj_sync failure 



The user can pass bad data into kgsl_ioctl_gpuobj_sync(). If
_copy_from_user() fails do to bad data, undo any current
references taken through this ioctl call.

Change-Id: I56195520b9dadba20ee419658fc2cbb282b8449c
Signed-off-by: default avatarCarter Cooper <ccooper@codeaurora.org>
parent 8cf0b1c9

drivers/gpu/msm/kgsl.c

+11 −15
Original line number Diff line number Diff line 
/* Copyright (c) 2008-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -2998,7 +2998,7 @@ long kgsl_ioctl_gpuobj_sync(struct kgsl_device_private *dev_priv, 
	long ret = 0;

	bool full_flush = false;

	uint64_t size = 0;

	int i, count = 0;

	int i;

	void __user *ptr;



	if (param->count == 0 || param->count > 128)
@@ -3010,8 +3010,8 @@ long kgsl_ioctl_gpuobj_sync(struct kgsl_device_private *dev_priv, 


	entries = kcalloc(param->count, sizeof(*entries), GFP_KERNEL);

	if (entries == NULL) {

		ret = -ENOMEM;

		goto out;

		kfree(objs);

		return -ENOMEM;

	}



	ptr = to_user_ptr(param->objs);
@@ -3028,8 +3028,6 @@ long kgsl_ioctl_gpuobj_sync(struct kgsl_device_private *dev_priv, 
		if (entries[i] == NULL)

			continue;



		count++;



		if (!(objs[i].op & KGSL_GPUMEM_CACHE_RANGE))

			size += entries[i]->memdesc.size;

		else if (objs[i].offset < entries[i]->memdesc.size)
@@ -3038,25 +3036,23 @@ long kgsl_ioctl_gpuobj_sync(struct kgsl_device_private *dev_priv, 
		full_flush = check_full_flush(size, objs[i].op);

		if (full_flush) {

			trace_kgsl_mem_sync_full_cache(i, size);

			break;

			goto out;

		}



		ptr += sizeof(*objs);

	}



	if (!full_flush) {

	for (i = 0; !ret && i < param->count; i++)

		if (entries[i])

			ret = _kgsl_gpumem_sync_cache(entries[i],

					objs[i].offset, objs[i].length,

					objs[i].op);

	}



out:

	for (i = 0; i < param->count; i++)

		if (entries[i])

			kgsl_mem_entry_put(entries[i]);



out:

	kfree(entries);

	kfree(objs);