Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 352e0ac2 authored by Archana Sriram's avatar Archana Sriram Committed by Gerrit - the friendly Code Review server
Browse files

msm: kgsl: Enhance reading lm_sequence in _execute_reg_sequence() 



Modified conditional checks to read lm_sequence so as to avoid
the possibility of pointer overflow.

CRs-Fixed: 2212443
Change-Id: I72b30e35996c40f23fc81739e27724b1188f1c05
Signed-off-by: default avatarArchana Sriram <apsrir@codeaurora.org>
parent b49908b7

drivers/gpu/msm/adreno_a5xx.c

+3 −3
Original line number Diff line number Diff line
@@ -1353,13 +1353,13 @@ static int _execute_reg_sequence(struct adreno_device *adreno_dev, 


	/* todo double check the reg writes */

	while ((cur - opcode) < length) {

		if (cur[0] == 1 && ((cur + 4) - opcode) <= length) {

		if (cur[0] == 1 && (length - (cur - opcode) >= 4)) {

			/* Write a 32 bit value to a 64 bit reg */

			reg = cur[2];

			reg = (reg << 32) | cur[1];

			kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, cur[3]);

			cur += 4;

		} else if (cur[0] == 2 && ((cur + 5) - opcode) <= length) {

		} else if (cur[0] == 2 && (length - (cur - opcode) >= 5)) {

			/* Write a 64 bit value to a 64 bit reg */

			reg = cur[2];

			reg = (reg << 32) | cur[1];
@@ -1367,7 +1367,7 @@ static int _execute_reg_sequence(struct adreno_device *adreno_dev, 
			val = (val << 32) | cur[3];

			kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, val);

			cur += 5;

		} else if (cur[0] == 3 && ((cur + 2) - opcode) <= length) {

		} else if (cur[0] == 3 && (length - (cur - opcode) >= 2)) {

			/* Delay for X usec */

			udelay(cur[1]);

			cur += 2;