Merge "msm: kgsl: verify user memory permissions before mapping to GPU driver" (3dbeaf3f) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/gpu/msm/kgsl.c

+22 −2

Original line number	Diff line number	Diff line
		@@ -1950,6 +1950,20 @@ static inline int _check_region(unsigned long start, unsigned long size,
		return (end > len);
		}

		static int check_vma_flags(struct vm_area_struct *vma,
		unsigned int flags)
		{
		unsigned long flags_requested = (VM_READ \| VM_WRITE);

		if (flags & KGSL_MEMFLAGS_GPUREADONLY)
		flags_requested &= ~VM_WRITE;

		if ((vma->vm_flags & flags_requested) == flags_requested)
		return 0;

		return -EFAULT;
		}

		static int check_vma(struct vm_area_struct vma, struct file vmfile,
		struct kgsl_memdesc *memdesc)
		{
		@@ -1963,7 +1977,7 @@ static int check_vma(struct vm_area_struct vma, struct file vmfile,
		if (vma->vm_start != memdesc->useraddr \|\|
		(memdesc->useraddr + memdesc->size) != vma->vm_end)
		return -EINVAL;
		return 0;
		return check_vma_flags(vma, memdesc->flags);
		}

		static int memdesc_sg_virt(struct kgsl_memdesc memdesc, struct file vmfile)
		@@ -1972,7 +1986,7 @@ static int memdesc_sg_virt(struct kgsl_memdesc memdesc, struct file vmfile)
		long npages = 0, i;
		size_t sglen = (size_t) (memdesc->size / PAGE_SIZE);
		struct page **pages = NULL;
		int write = (memdesc->flags & KGSL_MEMFLAGS_GPUREADONLY) != 0;
		int write = ((memdesc->flags & KGSL_MEMFLAGS_GPUREADONLY) ? 0 : 1);

		if (sglen == 0 \|\| sglen >= LONG_MAX)
		return -EINVAL;
		@@ -2091,6 +2105,12 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device,
		if (vma && vma->vm_file) {
		int fd;

		ret = check_vma_flags(vma, entry->memdesc.flags);
		if (ret) {
		up_read(&current->mm->mmap_sem);
		return ret;
		}

		/*
		* Check to see that this isn't our own memory that we have
		* already mapped