Merge "msm: mdss: Fix atomic commit compat layer copy" (88ee0254) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_compat_utils.c

+24 −11

Original line number	Diff line number	Diff line
		@@ -135,7 +135,6 @@ static struct mdp_input_layer32 *__create_layer_list32(
		int ret;

		buffer_size32 = sizeof(struct mdp_input_layer32) * layer_count;
		buffer_size32 += sizeof(struct mdp_output_layer32);

		layer_list32 = kmalloc(buffer_size32, GFP_KERNEL);
		if (!layer_list32) {
		@@ -145,11 +144,13 @@ static struct mdp_input_layer32 *__create_layer_list32(
		}

		ret = copy_from_user(layer_list32,
		commit32->commit_v1.input_layers,
		compat_ptr(commit32->commit_v1.input_layers),
		sizeof(struct mdp_input_layer32) * layer_count);
		if (ret) {
		pr_err("layer list32 copy from user failed\n");
		pr_err("layer list32 copy from user failed, ptr %p\n",
		compat_ptr(commit32->commit_v1.input_layers));
		kfree(layer_list32);
		ret = -EFAULT;
		layer_list32 = ERR_PTR(ret);
		}

		@@ -174,11 +175,13 @@ static int __copy_scale_params(struct mdp_input_layer *layer,
		}

		/* scale structure size is same for compat and 64bit version */
		ret = copy_from_user(scale, layer32->scale,
		ret = copy_from_user(scale, compat_ptr(layer32->scale),
		sizeof(struct mdp_scale_data));
		if (ret) {
		kfree(scale);
		pr_err("scale param copy from user failed\n");
		pr_err("scale param copy from user failed, ptr %p\n",
		compat_ptr(layer32->scale));
		ret = -EFAULT;
		} else {
		layer->scale = scale;
		}
		@@ -197,7 +200,6 @@ static struct mdp_input_layer *__create_layer_list(
		struct mdp_input_layer32 *layer32;

		buffer_size = sizeof(struct mdp_input_layer) * layer_count;
		buffer_size += sizeof(struct mdp_output_layer);

		layer_list = kmalloc(buffer_size, GFP_KERNEL);
		if (!layer_list) {
		@@ -223,7 +225,7 @@ static struct mdp_input_layer *__create_layer_list(
		layer->src_rect = layer32->src_rect;
		layer->dst_rect = layer32->dst_rect;
		layer->buffer = layer32->buffer;
		layer->pp_info = (void *)layer32->pp_info;
		layer->pp_info = compat_ptr(layer32->pp_info);
		memcpy(&layer->reserved, &layer32->reserved,
		sizeof(layer->reserved));

		@@ -257,12 +259,18 @@ static int __copy_to_user_atomic_commit(struct mdp_layer_commit *commit,
		for (i = 0; i < layer_count; i++)
		layer_list32[i].error_code = layer_list[i].error_code;

		ret = copy_to_user(commit32->commit_v1.input_layers,
		ret = copy_to_user(compat_ptr(commit32->commit_v1.input_layers),
		layer_list32,
		sizeof(struct mdp_input_layer32) * layer_count);
		if (ret)
		goto end;

		ret = copy_to_user(compat_ptr(commit32->commit_v1.output_layer),
		commit->commit_v1.output_layer,
		sizeof(struct mdp_output_layer));
		if (ret)
		goto end;

		commit32->commit_v1.release_fence =
		commit->commit_v1.release_fence;
		commit32->commit_v1.retire_fence =
		@@ -290,7 +298,9 @@ static int __compat_atomic_commit(struct fb_info *info, unsigned int cmd,
		ret = copy_from_user(&commit32, (void __user *)argp,
		sizeof(struct mdp_layer_commit32));
		if (ret) {
		pr_err("%s:copy_from_user failed\n", __func__);
		pr_err("%s:copy_from_user failed, ptr %p\n", __func__,
		(void __user *)argp);
		ret = -EFAULT;
		return ret;
		}
		__copy_atomic_commit_struct(&commit, &commit32);
		@@ -303,9 +313,12 @@ static int __compat_atomic_commit(struct fb_info *info, unsigned int cmd,
		return -ENOMEM;
		}
		ret = copy_from_user(output_layer,
		commit32.commit_v1.output_layer, buffer_size);
		compat_ptr(commit32.commit_v1.output_layer),
		buffer_size);
		if (ret) {
		pr_err("fail to copy output layer from user\n");
		pr_err("fail to copy output layer from user, ptr %p\n",
		compat_ptr(commit32.commit_v1.output_layer));
		ret = -EFAULT;
		goto layer_list_err;
		}

drivers/video/msm/mdss/mdss_compat_utils.h

+4 −4

Original line number	Diff line number	Diff line
		@@ -500,9 +500,9 @@ struct mdp_input_layer32 {
		enum mdss_mdp_blend_op blend_op;
		struct mdp_rect src_rect;
		struct mdp_rect dst_rect;
		compat_caddr_t __user *scale;
		compat_caddr_t scale;
		struct mdp_layer_buffer buffer;
		compat_caddr_t __user *pp_info;
		compat_caddr_t pp_info;
		int error_code;
		uint32_t reserved[6];
		};
		@@ -518,9 +518,9 @@ struct mdp_layer_commit_v1_32 {
		int release_fence;
		struct mdp_rect left_roi;
		struct mdp_rect right_roi;
		compat_caddr_t __user *input_layers;
		compat_caddr_t input_layers;
		uint32_t input_layer_cnt;
		compat_caddr_t __user *output_layer;
		compat_caddr_t output_layer;
		int retire_fence;
		uint32_t reserved[6];
		};

drivers/video/msm/mdss/mdss_mdp_pp_v1_7.c

+0 −5

Original line number	Diff line number	Diff line
		@@ -267,11 +267,6 @@ void pp_get_driver_ops(struct mdp_pp_driver_ops ops)
		ops->pp_ops[GAMUT].pp_get_config = pp_gamut_get_config;
		ops->pp_ops[GAMUT].pp_get_version = pp_gamut_get_version;

		/* CSC ops */
		ops->pp_ops[CSC].pp_set_config = NULL;
		ops->pp_ops[CSC].pp_get_config = NULL;
		ops->pp_ops[CSC].pp_get_version = NULL;

		/* Dither ops */
		ops->pp_ops[DITHER].pp_set_config = pp_dither_set_config;
		ops->pp_ops[DITHER].pp_get_config = pp_dither_get_config;

include/uapi/linux/msm_mdp.h

+0 −12

Original line number	Diff line number	Diff line
		@@ -440,20 +440,9 @@ struct mdp_csc_cfg {
		uint32_t csc_post_lv[MDP_CSC_CLAMP_SIZE];
		};

		struct mdp_csc_cfg_v1_7 {
		uint32_t csc_mv[MDP_CSC_MATRIX_COEFF_SIZE];
		uint32_t csc_pre_bv[MDP_CSC_BIAS_SIZE];
		uint32_t csc_post_bv[MDP_CSC_BIAS_SIZE];
		uint32_t csc_pre_lv[MDP_CSC_CLAMP_SIZE];
		uint32_t csc_post_lv[MDP_CSC_CLAMP_SIZE];
		};

		struct mdp_csc_cfg_data {
		uint32_t block;
		uint32_t version;
		uint32_t flags;
		struct mdp_csc_cfg csc_data;
		void *cfg_payload;
		};

		struct mdp_pa_cfg {
		@@ -1362,7 +1351,6 @@ enum {
		GC,
		PA,
		GAMUT,
		CSC,
		DITHER,
		QSEED,
		HIST_LUT,