Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c0a0c24c authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: kgsl: Fix overflow in sharedmem read/write functions"

parents 42d05f28 6f65a30c

drivers/gpu/msm/kgsl_sharedmem.c

+8 −8
Original line number Diff line number Diff line
@@ -852,8 +852,8 @@ kgsl_sharedmem_readl(const struct kgsl_memdesc *memdesc, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;



	rmb();
@@ -875,8 +875,8 @@ kgsl_sharedmem_writel(struct kgsl_device *device, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;

	kgsl_cffdump_write(device,

		memdesc->gpuaddr + offsetbytes,
@@ -901,8 +901,8 @@ kgsl_sharedmem_readq(const struct kgsl_memdesc *memdesc, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;



	/*
@@ -928,8 +928,8 @@ kgsl_sharedmem_writeq(struct kgsl_device *device, 
	if (offsetbytes % sizeof(uint32_t) != 0)

		return -EINVAL;



	WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size);

	if (offsetbytes + sizeof(uint32_t) > memdesc->size)

	WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t)));

	if (offsetbytes > (memdesc->size - sizeof(uint32_t)))

		return -ERANGE;

	kgsl_cffdump_write(device,

		lower_32_bits(memdesc->gpuaddr + offsetbytes), src);