Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87d229fd authored by Jordan Crouse's avatar Jordan Crouse
Browse files

msm: kgsl: Validate the meta data pointer in kgsl_destroy_ion() 



If kgsl_setup_ion() fails for whatever reason entry->priv_data may
either be NULL or pointing to freed memory. In either case, this
is a disaster when kgsl_destroy_ion() tries to use the unvalidated
pointer.  Check for NULL in kgsl_destroy_ion() and make sure that
the entry->priv_data pointer is cleared on error in kgsl_setup_ion.

Change-Id: Ic0dedbad6a13e2d8e15982144102517bc8f4e2e8
Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
parent 1b108580

drivers/gpu/msm/kgsl.c

+24 −17
Original line number Diff line number Diff line
@@ -198,11 +198,14 @@ kgsl_mem_entry_create(void) 


static void kgsl_destroy_ion(struct kgsl_dma_buf_meta *meta)

{

	dma_buf_unmap_attachment(meta->attach, meta->table, DMA_FROM_DEVICE);

	if (meta != NULL) {

		dma_buf_unmap_attachment(meta->attach, meta->table,

			DMA_FROM_DEVICE);

		dma_buf_detach(meta->dmabuf, meta->attach);

		dma_buf_put(meta->dmabuf);

		kfree(meta);

	}

}



void

kgsl_mem_entry_destroy(struct kref *kref)
@@ -2556,9 +2559,9 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry, 
	struct kgsl_map_user_mem *param = data;

	int fd = param->fd;

	struct dma_buf *dmabuf;

	struct dma_buf_attachment *attach;

	struct dma_buf_attachment *attach = NULL;

	struct kgsl_dma_buf_meta *meta;

	int ret;

	int ret = 0;



	if (!param->len)

		return -EINVAL;
@@ -2570,20 +2573,19 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry, 
	dmabuf = dma_buf_get(fd);

	if (IS_ERR_OR_NULL(dmabuf)) {

		ret = PTR_ERR(dmabuf);

		goto err1;

		goto out;

	}



	attach = dma_buf_attach(dmabuf, device->dev);

	if (IS_ERR_OR_NULL(attach)) {

		ret = PTR_ERR(attach);

		goto err2;

		goto out;

	}



	meta->dmabuf = dmabuf;

	meta->attach = attach;



	entry->memtype = KGSL_MEM_ENTRY_ION;

	entry->priv_data = meta;

	entry->memdesc.pagetable = pagetable;

	entry->memdesc.size = 0;

	/* USE_CPU_MAP is not impemented for ION. */
@@ -2593,10 +2595,11 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry, 


	if (IS_ERR_OR_NULL(sg_table)) {

		ret = PTR_ERR(sg_table);

		goto err3;

		goto out;

	}



	meta->table = sg_table;

	entry->priv_data = meta;

	entry->memdesc.sg = sg_table->sgl;



	/* Calculate the size of the memdesc from the sglist */
@@ -2610,13 +2613,17 @@ static int kgsl_setup_ion(struct kgsl_mem_entry *entry, 


	entry->memdesc.size = PAGE_ALIGN(entry->memdesc.size);



	return 0;

err3:

out:

	if (ret) {

		if (!IS_ERR_OR_NULL(attach))

			dma_buf_detach(dmabuf, attach);

err2:



		if (!IS_ERR_OR_NULL(dmabuf))

			dma_buf_put(dmabuf);

err1:



		kfree(meta);

	}



	return ret;

}