Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9b1aae1d authored by Archana Sriram's avatar Archana Sriram
Browse files

msm: kgsl: Fix reading lm_sequence in _execute_reg_sequence() 



Added proper checks while reading lm_sequence array so that it
is not accessed beyond lm_size.

CRs-Fixed: 2175951
Change-Id: I639b07fba275aad0f62cc03fa11201c126e24812
Signed-off-by: default avatarArchana Sriram <apsrir@codeaurora.org>
parent a2143369

drivers/gpu/msm/adreno_a5xx.c

+9 −13
Original line number Diff line number Diff line 
/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1265,31 +1265,27 @@ static int _execute_reg_sequence(struct adreno_device *adreno_dev, 


	/* todo double check the reg writes */

	while ((cur - opcode) < length) {

		switch (cur[0]) {

		if (cur[0] == 1 && ((cur + 4) - opcode) <= length) {

			/* Write a 32 bit value to a 64 bit reg */

		case 1:

			reg = cur[2];

			reg = (reg << 32) | cur[1];

			kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, cur[3]);

			cur += 4;

			break;

		} else if (cur[0] == 2 && ((cur + 5) - opcode) <= length) {

			/* Write a 64 bit value to a 64 bit reg */

		case 2:

			reg = cur[2];

			reg = (reg << 32) | cur[1];

			val = cur[4];

			val = (val << 32) | cur[3];

			kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, val);

			cur += 5;

			break;

		} else if (cur[0] == 3 && ((cur + 2) - opcode) <= length) {

			/* Delay for X usec */

		case 3:

			udelay(cur[1]);

			cur += 2;

			break;

		default:

		} else

			return -EINVAL;

	} }

	}

	return 0;

}