Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9594a69 authored by Jordan Crouse's avatar Jordan Crouse
Browse files

msm: cvp: Avoid overflowing the stack frame 



Building with llvm generates the following warning:

  drivers/media/platform/msm/cvp//msm_cvp_ioctl.c:611:13: warning: stack frame
  size of 2064 bytes in function 'cvp_ioctl' [-Wframe-larger-than=]

struct cvp_kmd_hfi_packet is 1880 bytes and is a member of a union inside
struct cvp_kmd_arg which eventually triggers the warning. Allocate the
struct from the heap instead.

Fixes: ffe925cb ("msm: cvp: Port CVP driver to 5.x kernel")
Change-Id: Ic0dedbad82d36b7faade85c3428b1013b527b576
Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
parent 33ed58ae

drivers/media/platform/msm/cvp/msm_cvp_ioctl.c

+14 −8
Original line number Diff line number Diff line
@@ -526,34 +526,40 @@ static long cvp_ioctl(struct msm_cvp_inst *inst, 
	unsigned int cmd, unsigned long arg)

{

	int rc;

	struct cvp_kmd_arg karg;

	struct cvp_kmd_arg *karg;



	if (!inst) {

		dprintk(CVP_ERR, "%s: invalid params\n", __func__);

		return -EINVAL;

	}



	memset(&karg, 0, sizeof(struct cvp_kmd_arg));

	karg = kzalloc(sizeof(*karg), GFP_KERNEL);

	if (!karg)

		return -ENOMEM;



	if (convert_from_user(&karg, arg, inst)) {

	if (convert_from_user(karg, arg, inst)) {

		dprintk(CVP_ERR, "%s: failed to get from user cmd %x\n",

			__func__, karg.type);

			__func__, karg->type);

		kfree(karg);

		return -EFAULT;

	}



	rc = msm_cvp_private((void *)inst, cmd, &karg);

	rc = msm_cvp_private((void *)inst, cmd, karg);

	if (rc) {

		dprintk(CVP_ERR, "%s: failed cmd type %x %d\n",

			__func__, karg.type, rc);

			__func__, karg->type, rc);

		kfree(karg);

		return rc;

	}



	if (convert_to_user(&karg, arg)) {

	if (convert_to_user(karg, arg)) {

		dprintk(CVP_ERR, "%s: failed to copy to user cmd %x\n",

			__func__, karg.type);

			__func__, karg->type);

		kfree(karg);

		return -EFAULT;

	}



	kfree(karg);

	return rc;

}