Commit 11a600bc authored Oct 15, 2019 by Archana Sriram Committed by Harshitha Sai Neelati Oct 17, 2019

msm: kgsl: Check user generated timestamp before queuing drawobjs



In ioctls like kgsl_ioctl_submit_commands(), if both syncobj
type and cmd/marker/sparseobj type are submitted, the syncobj
is queued first followed by the other obj type. After syncobj
is successfully queued, in case of failure in get_timestamp
while queuing the other obj, both the command objs are
destroyed. As sync obj is already queued, accessing this
later would cause a crash.

Compare the user generated timestamp with the drawctxt
timestamp and return early in case of error. This avoids
unnecessary queuing of drawobjs.

Change-Id: I336c95c42ab1075d7653cba02772f92c918c884c
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
Signed-off-by: Harshitha Sai Neelati <hsaine@codeaurora.org>

parent eca47d45

drivers/gpu/msm/adreno_dispatch.c

+16 −0

Original line number	Diff line number	Diff line
		@@ -1380,6 +1380,22 @@ int adreno_dispatcher_queue_cmds(struct kgsl_device_private *dev_priv,

		user_ts = *timestamp;

		/*
		* If there is only one drawobj in the array and it is of
		* type SYNCOBJ_TYPE, skip comparing user_ts as it can be 0
		*/
		if (!(count == 1 && drawobj[0]->type == SYNCOBJ_TYPE) &&
		(drawctxt->base.flags & KGSL_CONTEXT_USER_GENERATED_TS)) {
		/*
		* User specified timestamps need to be greater than the last
		* issued timestamp in the context
		*/
		if (timestamp_cmp(drawctxt->timestamp, user_ts) >= 0) {
		spin_unlock(&drawctxt->lock);
		return -ERANGE;
		}
		}

		for (i = 0; i < count; i++) {

		switch (drawobj[i]->type) {