Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 903129f4 authored by Jordan Crouse's avatar Jordan Crouse
Browse files

msm: kgsl: Fix some questionable pointer math in the profile code 



Commit 4f40ffa1 passes a pointer to
a pointer to the ringbuffer memory to adreno_profile_preib_processing
and adreno_profile_postib_processing and expects those functions to
dereference the pointer and write to it.  Unfortunately, the pointer
math attempted to be more clever than the compiler and lost resulting
in a kernel panic when this code is run.

Explicitly dereference the pointer use it and then store the new
pointer back leaving nothing to chance or compiler.

Change-Id: Ic0dedbadf85d0d0c52de69a5af72080229c03dca
Signed-off-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
parent 67a06d8e

drivers/gpu/msm/adreno_profile.c

+12 −6
Original line number Diff line number Diff line
@@ -1100,6 +1100,7 @@ void adreno_profile_preib_processing(struct kgsl_device *device, 
	struct adreno_ringbuffer *rb = &adreno_dev->ringbuffer;

	unsigned int rbcmds[3] = { cp_nop_packet(2),

		KGSL_NOP_IB_IDENTIFIER, KGSL_NOP_IB_IDENTIFIER };

	unsigned int *ptr = *rbptr;



	*cmd_flags &= ~KGSL_CMD_FLAGS_PROFILE;
@@ -1145,9 +1146,11 @@ void adreno_profile_preib_processing(struct kgsl_device *device, 


done:

	/* write the ibdesc to the ringbuffer */

	*(*rbptr++) = rbcmds[0];

	*(*rbptr++) = rbcmds[1];

	*(*rbptr++) = rbcmds[2];

	*ptr++ = rbcmds[0];

	*ptr++ = rbcmds[1];

	*ptr++ = rbcmds[2];



	*rbptr = ptr;

}



void adreno_profile_postib_processing(struct kgsl_device *device,
@@ -1160,6 +1163,7 @@ void adreno_profile_postib_processing(struct kgsl_device *device, 
		SIZE_SHARED_ENTRY(count);

	unsigned int rbcmds[3] = { cp_nop_packet(2),

		KGSL_NOP_IB_IDENTIFIER, KGSL_NOP_IB_IDENTIFIER };

	unsigned int *ptr = *rbptr;



	if (!adreno_profile_assignments_ready(profile))

		goto done;
@@ -1172,9 +1176,11 @@ void adreno_profile_postib_processing(struct kgsl_device *device, 


done:

	/* write the ibdesc to the ringbuffer */

	*(*rbptr++) = rbcmds[0];

	*(*rbptr++) = rbcmds[1];

	*(*rbptr++) = rbcmds[2];

	*ptr++ = rbcmds[0];

	*ptr++ = rbcmds[1];

	*ptr++ = rbcmds[2];



	*rbptr = ptr;



	/* reset the sync flag */

	*cmd_flags &= ~KGSL_CMD_FLAGS_PROFILE;