Merge "msm: kgsl: Fix out of bound write in adreno_profile_submit_time" (d54b4c37) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/gpu/msm/kgsl_drawobj.c

+10 −23

Original line number	Diff line number	Diff line
		@@ -715,6 +715,7 @@ static void add_profiling_buffer(struct kgsl_device *device,
		{
		struct kgsl_mem_entry *entry;
		struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
		u64 start;

		if (!(drawobj->flags & KGSL_DRAWOBJ_PROFILING))
		return;
		@@ -731,7 +732,14 @@ static void add_profiling_buffer(struct kgsl_device *device,
		gpuaddr);

		if (entry != NULL) {
		if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size)) {
		start = id ? (entry->memdesc.gpuaddr + offset) : gpuaddr;
		/*
		* Make sure there is enough room in the object to store the
		* entire profiling buffer object
		*/
		if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size) \|\|
		!kgsl_gpuaddr_in_memdesc(&entry->memdesc, start,
		sizeof(struct kgsl_drawobj_profiling_buffer))) {
		kgsl_mem_entry_put(entry);
		entry = NULL;
		}
		@@ -744,28 +752,7 @@ static void add_profiling_buffer(struct kgsl_device *device,
		return;
		}


		if (!id) {
		cmdobj->profiling_buffer_gpuaddr = gpuaddr;
		} else {
		u64 off = offset + sizeof(struct kgsl_drawobj_profiling_buffer);

		/*
		* Make sure there is enough room in the object to store the
		* entire profiling buffer object
		*/
		if (off < offset \|\| off >= entry->memdesc.size) {
		dev_err(device->dev,
		"ignore invalid profile offset ctxt %d id %d offset %lld gpuaddr %llx size %lld\n",
		drawobj->context->id, id, offset, gpuaddr, size);
		kgsl_mem_entry_put(entry);
		return;
		}

		cmdobj->profiling_buffer_gpuaddr =
		entry->memdesc.gpuaddr + offset;
		}

		cmdobj->profiling_buffer_gpuaddr = start;
		cmdobj->profiling_buf_entry = entry;
		}