Merge "msm: kgsl: Validate the meta data pointer in kgsl_destroy_ion()" (842cd668) · Commits · e / devices / android_kernel_sony_msm8994

drivers/gpu/msm/kgsl.c

+24 −17

Original line number	Diff line number	Diff line
		@@ -198,11 +198,14 @@ kgsl_mem_entry_create(void)

		static void kgsl_destroy_ion(struct kgsl_dma_buf_meta *meta)
		{
		dma_buf_unmap_attachment(meta->attach, meta->table, DMA_FROM_DEVICE);
		if (meta != NULL) {
		dma_buf_unmap_attachment(meta->attach, meta->table,
		DMA_FROM_DEVICE);
		dma_buf_detach(meta->dmabuf, meta->attach);
		dma_buf_put(meta->dmabuf);
		kfree(meta);
		}
		}

		void
		kgsl_mem_entry_destroy(struct kref *kref)
		@@ -2556,9 +2559,9 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry,
		struct kgsl_map_user_mem *param = data;
		int fd = param->fd;
		struct dma_buf *dmabuf;
		struct dma_buf_attachment *attach;
		struct dma_buf_attachment *attach = NULL;
		struct kgsl_dma_buf_meta *meta;
		int ret;
		int ret = 0;

		if (!param->len)
		return -EINVAL;
		@@ -2570,20 +2573,19 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry,
		dmabuf = dma_buf_get(fd);
		if (IS_ERR_OR_NULL(dmabuf)) {
		ret = PTR_ERR(dmabuf);
		goto err1;
		goto out;
		}

		attach = dma_buf_attach(dmabuf, device->dev);
		if (IS_ERR_OR_NULL(attach)) {
		ret = PTR_ERR(attach);
		goto err2;
		goto out;
		}

		meta->dmabuf = dmabuf;
		meta->attach = attach;

		entry->memtype = KGSL_MEM_ENTRY_ION;
		entry->priv_data = meta;
		entry->memdesc.pagetable = pagetable;
		entry->memdesc.size = 0;
		/* USE_CPU_MAP is not impemented for ION. */
		@@ -2593,10 +2595,11 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry,

		if (IS_ERR_OR_NULL(sg_table)) {
		ret = PTR_ERR(sg_table);
		goto err3;
		goto out;
		}

		meta->table = sg_table;
		entry->priv_data = meta;
		entry->memdesc.sg = sg_table->sgl;

		/* Calculate the size of the memdesc from the sglist */
		@@ -2610,13 +2613,17 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry,

		entry->memdesc.size = PAGE_ALIGN(entry->memdesc.size);

		return 0;
		err3:
		out:
		if (ret) {
		if (!IS_ERR_OR_NULL(attach))
		dma_buf_detach(dmabuf, attach);
		err2:

		if (!IS_ERR_OR_NULL(dmabuf))
		dma_buf_put(dmabuf);
		err1:

		kfree(meta);
		}

		return ret;
		}