Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 92dac66f authored by Alexander Beykun's avatar Alexander Beykun Committed by Gerrit - the friendly Code Review server
Browse files

drm/msm: add null checks to msm_rd.c 



Add input pointer validation to the msm_rd.c file.

Change-Id: Id13bb3a0dae2289a2d29b2917dffd1714f7c24bd
Signed-off-by: default avatarAlexander Beykun <abeykun@codeaurora.org>
parent 0e6032e3

drivers/gpu/drm/msm/msm_rd.c

+65 −16
Original line number Diff line number Diff line
@@ -105,9 +105,13 @@ struct msm_rd_state { 


static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)

{

	struct circ_buf *fifo = &rd->fifo;

	struct circ_buf *fifo;

	const char *ptr = buf;



	if (!rd || !buf)

		return;



	fifo = &rd->fifo;

	while (sz > 0) {

		char *fptr = &fifo->buf[fifo->head];

		int n;
@@ -136,11 +140,18 @@ static void rd_write_section(struct msm_rd_state *rd, 
static ssize_t rd_read(struct file *file, char __user *buf,

		size_t sz, loff_t *ppos)

{

	struct msm_rd_state *rd = file->private_data;

	struct circ_buf *fifo = &rd->fifo;

	const char *fptr = &fifo->buf[fifo->tail];

	struct msm_rd_state *rd;

	struct circ_buf *fifo;

	const char *fptr;

	int n = 0, ret = 0;



	if (!file || !file->private_data || !buf || !ppos)

		return -EINVAL;



	rd = file->private_data;

	fifo = &rd->fifo;

	fptr = &fifo->buf[fifo->tail];



	mutex_lock(&rd->read_lock);



	ret = wait_event_interruptible(rd->fifo_event,
@@ -168,19 +179,34 @@ static ssize_t rd_read(struct file *file, char __user *buf, 


static int rd_open(struct inode *inode, struct file *file)

{

	struct msm_rd_state *rd = inode->i_private;

	struct drm_device *dev = rd->dev;

	struct msm_drm_private *priv = dev->dev_private;

	struct msm_gpu *gpu = priv->gpu;

	struct msm_rd_state *rd;

	struct drm_device *dev;

	struct msm_drm_private *priv;

	struct msm_gpu *gpu;

	uint64_t val;

	uint32_t gpu_id;

	int ret = 0;



	if (!file || !inode || !inode->i_private)

		return -EINVAL;



	rd = inode->i_private;

	dev = rd->dev;



	if (!dev || !dev->dev_private)

		return -EINVAL;



	priv = dev->dev_private;

	gpu = priv->gpu;



	mutex_lock(&dev->struct_mutex);



	if (rd->open || !gpu) {

		ret = -EBUSY;

		goto out;

	} else if (!gpu->funcs || !gpu->funcs->get_param) {

		ret = -EINVAL;

		goto out;

	}



	file->private_data = rd;
@@ -201,7 +227,12 @@ static int rd_open(struct inode *inode, struct file *file) 


static int rd_release(struct inode *inode, struct file *file)

{

	struct msm_rd_state *rd = inode->i_private;

	struct msm_rd_state *rd;



	if (!inode || !inode->i_private)

		return -EINVAL;



	rd = inode->i_private;

	rd->open = false;

	return 0;

}
@@ -217,9 +248,14 @@ static const struct file_operations rd_debugfs_fops = { 


int msm_rd_debugfs_init(struct drm_minor *minor)

{

	struct msm_drm_private *priv = minor->dev->dev_private;

	struct msm_drm_private *priv;

	struct msm_rd_state *rd;



	if (!minor || !minor->dev || !minor->dev->dev_private)

		return -EINVAL;



	priv = minor->dev->dev_private;



	/* only create on first minor: */

	if (priv->rd)

		return 0;
@@ -265,8 +301,14 @@ int msm_rd_debugfs_init(struct drm_minor *minor) 


void msm_rd_debugfs_cleanup(struct drm_minor *minor)

{

	struct msm_drm_private *priv = minor->dev->dev_private;

	struct msm_rd_state *rd = priv->rd;

	struct msm_drm_private *priv;

	struct msm_rd_state *rd;



	if (!minor || !minor->dev || !minor->dev->dev_private)

		return;



	priv = minor->dev->dev_private;

	rd = priv->rd;



	if (!rd)

		return;
@@ -315,13 +357,20 @@ static void snapshot_buf(struct msm_rd_state *rd, 
/* called under struct_mutex */

void msm_rd_dump_submit(struct msm_gem_submit *submit)

{

	struct drm_device *dev = submit->dev;

	struct msm_drm_private *priv = dev->dev_private;

	struct msm_rd_state *rd = priv->rd;

	struct drm_device *dev;

	struct msm_drm_private *priv;

	struct msm_rd_state *rd;

	char msg[128];

	int i, n;



	if (!rd->open)

	if (!submit || !submit->dev || !submit->dev->dev_private)

		return;



	dev = submit->dev;

	priv = dev->dev_private;

	rd = priv->rd;



	if (!rd || !rd->open)

		return;



	/* writing into fifo is serialized by caller, and