diff options
| author | Archana Sriram <apsrir@codeaurora.org> | 2018-02-09 17:50:19 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-02-26 22:43:21 -0800 |
| commit | b8ba9c35c22145ae382b53c5ceb8dfd003508057 (patch) | |
| tree | c5f083023b5587f6a287f31884951d9486c760b8 /drivers/gpu | |
| parent | 17c46a04781867855b696b729e26500dab316870 (diff) | |
msm: kgsl: Fix reading lm_sequence in _execute_reg_sequence()
Added proper checks while reading lm_sequence array so that it
is not accessed beyond lm_size.
CRs-Fixed: 2175951
Change-Id: I639b07fba275aad0f62cc03fa11201c126e24812
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/msm/adreno_a5xx.c | 20 |
1 files changed, 8 insertions, 12 deletions
diff --git a/drivers/gpu/msm/adreno_a5xx.c b/drivers/gpu/msm/adreno_a5xx.c index 2b8c593076cb..cd8cb7837911 100644 --- a/drivers/gpu/msm/adreno_a5xx.c +++ b/drivers/gpu/msm/adreno_a5xx.c @@ -1376,31 +1376,27 @@ static int _execute_reg_sequence(struct adreno_device *adreno_dev, /* todo double check the reg writes */ while ((cur - opcode) < length) { - switch (cur[0]) { - /* Write a 32 bit value to a 64 bit reg */ - case 1: + if (cur[0] == 1 && ((cur + 4) - opcode) <= length) { + /* Write a 32 bit value to a 64 bit reg */ reg = cur[2]; reg = (reg << 32) | cur[1]; kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, cur[3]); cur += 4; - break; - /* Write a 64 bit value to a 64 bit reg */ - case 2: + } else if (cur[0] == 2 && ((cur + 5) - opcode) <= length) { + /* Write a 64 bit value to a 64 bit reg */ reg = cur[2]; reg = (reg << 32) | cur[1]; val = cur[4]; val = (val << 32) | cur[3]; kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, val); cur += 5; - break; - /* Delay for X usec */ - case 3: + } else if (cur[0] == 3 && ((cur + 2) - opcode) <= length) { + /* Delay for X usec */ udelay(cur[1]); cur += 2; - break; - default: + } else return -EINVAL; - } } + } return 0; } |