joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

msm: kgsl: Fix out of bound write in adreno_profile_submit_time

Browse source 
Make sure there is enough room in the memory descriptor to store the
entire profiling buffer object.

Change-Id: I1e1c73097bb2bba9645b0a3c66fdbbc71d8ba8fa
Signed-off-by: Kamal Agrawal <kamaagra@codeaurora.org>
This commit is contained in:
Kamal Agrawal 2021-09-13 15:59:25 +05:30 • committed by Gerrit - the friendly Code Review server
commit 77d3ec60d1
1 changed files with 11 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

35
drivers/gpu/msm/kgsl_drawobj.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
/* Copyright (c) 2016-2019,2021, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -569,6 +569,7 @@ static void add_profiling_buffer(struct kgsl_device *device,
{
struct kgsl_mem_entry *entry;
struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj);
u64 start;
if (!(drawobj->flags & KGSL_DRAWOBJ_PROFILING))
return;
@ -585,7 +586,14 @@ static void add_profiling_buffer(struct kgsl_device *device,
gpuaddr);
if (entry != NULL) {
if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size)) {
start = id ? (entry->memdesc.gpuaddr + offset) : gpuaddr;
/*
* Make sure there is enough room in the object to store the
* entire profiling buffer object
*/
if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size) ||
!kgsl_gpuaddr_in_memdesc(&entry->memdesc, start,
sizeof(struct kgsl_drawobj_profiling_buffer))) {
kgsl_mem_entry_put(entry);
entry = NULL;
}
@ -598,28 +606,7 @@ static void add_profiling_buffer(struct kgsl_device *device,
return;
}
if (!id) {
cmdobj->profiling_buffer_gpuaddr = gpuaddr;
} else {
u64 off = offset + sizeof(struct kgsl_drawobj_profiling_buffer);
/*
* Make sure there is enough room in the object to store the
* entire profiling buffer object
*/
if (off < offset || off >= entry->memdesc.size) {
dev_err(device->dev,
"ignore invalid profile offset ctxt %d id %d offset %lld gpuaddr %llx size %lld\n",
drawobj->context->id, id, offset, gpuaddr, size);
kgsl_mem_entry_put(entry);
return;
}
cmdobj->profiling_buffer_gpuaddr =
entry->memdesc.gpuaddr + offset;
}
cmdobj->profiling_buffer_gpuaddr = start;
cmdobj->profiling_buf_entry = entry;
}