Merge "Revert "fix memory corruption in map_buffer TBUG-411 TQC-24"" (2f2b62f7) · Commits · e / devices / android_kernel_sony_msm8994

drivers/gud/MobiCoreDriver/mem.c

+16 −15

Original line number	Diff line number	Diff line
		@@ -347,7 +347,7 @@ static int map_buffer(struct task_struct task, void wsm_buffer,
		void *virt_addr_page;
		struct page *page;
		struct mmutable *mmutable;
		struct page **mmutable_as_array_of_pointers_to_page = NULL;
		struct page **mmutable_as_array_of_pointers_to_page;
		/* page offset in wsm buffer */
		unsigned int offset;

		@@ -384,21 +384,12 @@ static int map_buffer(struct task_struct task, void wsm_buffer,
		}

		mmutable = table->virt;
		#if (defined LPAE_SUPPORT) \|\| !(defined CONFIG_ARM64)
		/*
		* We use the memory for the MMU table to hold the pointer
		* and convert them later. This works, as everything comes
		* down to a 32 bit value.
		*/
		mmutable_as_array_of_pointers_to_page = (struct page **)mmutable;
		#else
		mmutable_as_array_of_pointers_to_page = kmalloc(
		sizeof(struct page )nr_of_pages, GFP_KERNEL \| __GFP_ZERO);
		if (mmutable_as_array_of_pointers_to_page == NULL) {
		ret = -ENOMEM;
		goto map_buffer_end;
		}
		#endif

		/* Request comes from user space */
		if (task != NULL && !is_vmalloc_addr(wsm_buffer)) {
		@@ -416,7 +407,7 @@ static int map_buffer(struct task_struct task, void wsm_buffer,
		mmutable_as_array_of_pointers_to_page);
		if (ret != 0) {
		MCDRV_DBG_ERROR(mcd, "lock_user_pages() failed");
		goto map_buffer_end;
		return ret;
		}
		}
		/* Request comes from kernel space(cont buffer) */
		@@ -458,10 +449,20 @@ static int map_buffer(struct task_struct task, void wsm_buffer,
		* - or fails and used_mmutable->table contains the list of page
		* pointers.
		* Any mixed contents will make cleanup difficult.
		*/
		#if defined(CONFIG_ARM64) && !defined(LPAE_SUPPORT)
		/*
		* When NWd pointers are 64bits and SWd pte 32bits we need to fill the
		* table from 0.
		*/
		i = 0;
		#else
		/*
		* Fill the table in reverse order as the table is used as input and
		* output.
		*/
		i = MC_ARM_MMU_TABLE_ENTRIES-1;
		#endif
		do {
		if (i < nr_of_pages) {
		#ifdef LPAE_SUPPORT
		@@ -520,12 +521,12 @@ static int map_buffer(struct task_struct task, void wsm_buffer,
		/* ensure rest of table is empty */
		mmutable->table_entries[i] = 0;
		}
		#if defined(CONFIG_ARM64) && !defined(LPAE_SUPPORT)
		} while (++i < MC_ARM_MMU_TABLE_ENTRIES);
		#else
		} while (i-- != 0);

		map_buffer_end:
		#if !(defined LPAE_SUPPORT) && (defined CONFIG_ARM64)
		kfree(mmutable_as_array_of_pointers_to_page);
		#endif

		return ret;
		}