Merge tag 'LA.UM.8.4.c25-06600-8x98.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.4 into android13-4.4-msm8998

"LA.UM.8.4.c25-06600-8x98.0"

* tag 'LA.UM.8.4.c25-06600-8x98.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.4:
  diag: Prevent out of bound write while sending dci pkt to remote
  diag: Ensure dci entry is valid before sending the packet
  ion: Fix integer overflow in msm_ion_custom_ioctl
  diag: Use valid data_source for a valid token
  msm: kgsl: Remove 'fd' dependency to get dma_buf handle
  msm: kgsl: Fix gpuaddr_in_range() to check upper bound
  msm: adsprpc: Handle UAF in fastrpc debugfs read
  msm: kgsl: Add a sysfs node to control performance counter reads
  msm: kgsl: Perform cache flush on the pages obtained using get_user_pages()
  soc: qcom: hab: Add sanity check for payload_count
  msm: kgsl: Fix out of bound write in adreno_profile_submit_time
  futex: Fix inode life-time issue
  futex: Handle faults correctly for PI futexes
  futex: Simplify fixup_pi_state_owner()
  futex: Use pi_state_update_owner() in put_pi_state()
  rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
  futex: Provide and use pi_state_update_owner()
  futex: Replace pointless printk in fixup_owner()
  futex: Avoid violating the 10th rule of futex
  futex: Rework inconsistent rt_mutex/futex_q state
  futex: Remove rt_mutex_deadlock_account_*()
  futex,rt_mutex: Provide futex specific rt_mutex API
  msm: adsprpc: Handle UAF in process shell memory
  Disable TRACER Check to improve Camera Performance
  msm: kgsl: Deregister gpu address on memdesc_sg_virt failure
  crypto: Fix possible stack out-of-bound error
  msm: kgsl: Correct the refcount on current process PID.
  msm: kgsl: Compare pid pointer instead of TGID for a new process
  qcom,max-freq-level change for trial
  msm: kgsl: Protect the memdesc->gpuaddr in SVM use cases.
  msm: kgsl: Stop using memdesc->usermem.

 Conflicts:
	drivers/char/adsprpc.c
	drivers/char/diag/diag_dci.c
	drivers/gpu/msm/kgsl.c
	drivers/gpu/msm/kgsl_debugfs.c
	drivers/gpu/msm/kgsl_iommu.c
	drivers/gpu/msm/kgsl_mmu.c
	drivers/gpu/msm/kgsl_sharedmem.c
	drivers/gpu/msm/kgsl_trace.h
	kernel/futex.c
	kernel/locking/rtmutex.c
	kernel/locking/rtmutex_common.h

Change-Id: I777ee96b855e2967ef6733e603d12f40174974d0

1 files changed, 6 insertions, 4 deletions

diff --git a/drivers/gpu/msm/kgsl_iommu.c b/drivers/gpu/msm/kgsl_iommu.c
index 98537730cbc9..31e8a7ea5f65 100644
--- a/drivers/gpu/msm/kgsl_iommu.c
+++ b/drivers/gpu/msm/kgsl_iommu.c
@@ -1,4 +1,5 @@
 /* Copyright (c) 2011-2021, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -2525,20 +2526,21 @@ static int kgsl_iommu_svm_range(struct kgsl_pagetable *pagetable,
 }
 
 static bool kgsl_iommu_addr_in_range(struct kgsl_pagetable *pagetable,
-		uint64_t gpuaddr)
+		uint64_t gpuaddr, uint64_t size)
 {
 	struct kgsl_iommu_pt *pt = pagetable->priv;
 
 	if (gpuaddr == 0)
 		return false;
 
-	if (gpuaddr >= pt->va_start && gpuaddr < pt->va_end)
+	if (gpuaddr >= pt->va_start && (gpuaddr + size) < pt->va_end)
 		return true;
 
-	if (gpuaddr >= pt->compat_va_start && gpuaddr < pt->compat_va_end)
+	if (gpuaddr >= pt->compat_va_start &&
+			(gpuaddr + size) < pt->compat_va_end)
 		return true;
 
-	if (gpuaddr >= pt->svm_start && gpuaddr < pt->svm_end)
+	if (gpuaddr >= pt->svm_start && (gpuaddr + size) < pt->svm_end)
 		return true;
 
 	return false;