Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f65a30c authored by Sunil Khatri's avatar Sunil Khatri
Browse files

msm: kgsl: Fix overflow in sharedmem read/write functions 



There could be possibility of integer overflow on adding
sizeof(uint32_t) with uint64_t maximum offset bytes and result
in a value smaller than uint64_t maximum memdesc size.

CRs-Fixed: 988861
Change-Id: Ifc3ec45297c2a29ad6f7d70dd0bd59238ac8cc3d
Signed-off-by: default avatarSunil Khatri <sunilkh@codeaurora.org>
parent ee833ce5

drivers/gpu/msm/kgsl_sharedmem.c

+8 −8
Original line number Diff line number Diff line
@@ -901,8 +901,8 @@ kgsl_sharedmem_readl(const struct kgsl_memdesc *memdesc, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;



	rmb();
@@ -924,8 +924,8 @@ kgsl_sharedmem_writel(struct kgsl_device *device, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;

	kgsl_cffdump_write(device,

		memdesc->gpuaddr + offsetbytes,
@@ -950,8 +950,8 @@ kgsl_sharedmem_readq(const struct kgsl_memdesc *memdesc, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;



	/*
@@ -977,8 +977,8 @@ kgsl_sharedmem_writeq(struct kgsl_device *device, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;

	kgsl_cffdump_write(device,

		lower_32_bits(memdesc->gpuaddr + offsetbytes), src);