TononixOS/ubports_kernel_google_msm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

msm: kgsl: Verify the user doesn't accidentally submit a zero length IB

Browse Source 
Indirect buffers to be executed will not be (and cannot be) zero length.
Check and reject.

Change-Id: Ic0dedbadea429c4f7bd386c5e64603b51ea8af61
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Sakshi Agrawal <sakshia@codeaurora.org>
This commit is contained in:
Sakshi Agrawal
2013-03-19 11:08:25 -06:00
committed by Iliyan Malchev
parent 944d45c635
commit bd640bd03a
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/gpu/msm/adreno_ringbuffer.c
View File

@@ -962,6 +962,7 @@ adreno_ringbuffer_issueibcmds(struct kgsl_device_private *dev_priv,
unsigned int i;
struct adreno_context *drawctxt;
unsigned int start_index = 0;
int ret = 0;
if (device->state & KGSL_STATE_HUNG)
return -EBUSY;
@@ -1018,9 +1019,15 @@ adreno_ringbuffer_issueibcmds(struct kgsl_device_private *dev_priv,
if (unlikely(adreno_dev->ib_check_level >= 1 &&
!_parse_ibs(dev_priv, ibdesc[i].gpuaddr,
ibdesc[i].sizedwords))) {
kfree(link);
return -EINVAL;
ret = -EINVAL;
goto done;
}
if (ibdesc[i].sizedwords == 0) {
ret = -EINVAL;
goto done;
}
*cmds++ = CP_HDR_INDIRECT_BUFFER_PFD;
*cmds++ = ibdesc[i].gpuaddr;
*cmds++ = ibdesc[i].sizedwords;
@@ -1043,7 +1050,6 @@ adreno_ringbuffer_issueibcmds(struct kgsl_device_private *dev_priv,
KGSL_CMD_INFO(device, "ctxt %d g %08x numibs %d ts %d\n",
context->id, (unsigned int)ibdesc, numibs, *timestamp);
kfree(link);
#ifdef CONFIG_MSM_KGSL_CFF_DUMP
/*
@@ -1060,9 +1066,12 @@ adreno_ringbuffer_issueibcmds(struct kgsl_device_private *dev_priv,
*/
if (drawctxt->flags & CTXT_FLAGS_GPU_HANG_FT) {
drawctxt->flags &= ~CTXT_FLAGS_GPU_HANG_FT;
return -EPROTO;
} else
return 0;
ret = -EPROTO;
}
done:
kfree(link);
return ret;
}
static void _turn_preamble_on_for_ib_seq(struct adreno_ringbuffer *rb,