diff options
| -rw-r--r-- | drivers/gpu/msm/adreno_drawctxt.c | 12 | ||||
| -rw-r--r-- | drivers/gpu/msm/adreno_iommu.c | 13 | ||||
| -rw-r--r-- | sound/soc/msm/qdsp6v2/q6voice.c | 15 |
3 files changed, 33 insertions, 7 deletions
diff --git a/drivers/gpu/msm/adreno_drawctxt.c b/drivers/gpu/msm/adreno_drawctxt.c index 446df0e98217..94d0e6d6b8dd 100644 --- a/drivers/gpu/msm/adreno_drawctxt.c +++ b/drivers/gpu/msm/adreno_drawctxt.c @@ -1,4 +1,5 @@ /* Copyright (c) 2002,2007-2017,2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -609,8 +610,6 @@ int adreno_drawctxt_switch(struct adreno_device *adreno_dev, if (drawctxt != NULL && kgsl_context_detached(&drawctxt->base)) return -ENOENT; - trace_adreno_drawctxt_switch(rb, drawctxt); - /* Get a refcount to the new instance */ if (drawctxt) { if (!_kgsl_context_get(&drawctxt->base)) @@ -623,7 +622,7 @@ int adreno_drawctxt_switch(struct adreno_device *adreno_dev, } ret = adreno_ringbuffer_set_pt_ctx(rb, new_pt, drawctxt, flags); if (ret) - return ret; + goto err; if (rb->drawctxt_active) { /* Wait for the timestamp to expire */ @@ -634,6 +633,13 @@ int adreno_drawctxt_switch(struct adreno_device *adreno_dev, } } + trace_adreno_drawctxt_switch(rb, drawctxt); + rb->drawctxt_active = drawctxt; + return 0; +err: + if (drawctxt) + kgsl_context_put(&drawctxt->base); + return ret; } diff --git a/drivers/gpu/msm/adreno_iommu.c b/drivers/gpu/msm/adreno_iommu.c index 4bb7f6286664..9216d6f07119 100644 --- a/drivers/gpu/msm/adreno_iommu.c +++ b/drivers/gpu/msm/adreno_iommu.c @@ -1,4 +1,5 @@ /* Copyright (c) 2002,2007-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -890,5 +891,17 @@ int adreno_iommu_set_pt_ctx(struct adreno_ringbuffer *rb, else result = _set_ctxt_gpu(rb, drawctxt); + /* + * In case ctxt switch fails, revert the pagetable back to the + * original. Not reverting the pagetable will lead to incorrect + * hardware state in the ringbuffer. + */ + if (result && (new_pt != cur_pt)) { + if (cpu_path) + result = _set_pagetable_cpu(rb, cur_pt); + else + result = _set_pagetable_gpu(rb, cur_pt); + } + return result; } diff --git a/sound/soc/msm/qdsp6v2/q6voice.c b/sound/soc/msm/qdsp6v2/q6voice.c index 996567ff3a0e..a1f1fafbdf8d 100644 --- a/sound/soc/msm/qdsp6v2/q6voice.c +++ b/sound/soc/msm/qdsp6v2/q6voice.c @@ -1,5 +1,5 @@ /* Copyright (c) 2012-2018, 2020, The Linux Foundation. All rights reserved. - * + * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and * only version 2 as published by the Free Software Foundation. @@ -17,6 +17,7 @@ #include <linux/wait.h> #include <linux/mutex.h> #include <linux/msm_audio_ion.h> +#include <linux/overflow.h> #include <soc/qcom/socinfo.h> #include <linux/qdsp6v2/apr_tal.h> @@ -6771,7 +6772,7 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_READY) { int ret = 0; u16 cvs_handle; - uint32_t *cvs_voc_pkt; + uint32_t *cvs_voc_pkt, tot_buf_sz; struct cvs_enc_buffer_consumed_cmd send_enc_buf_consumed_cmd; void *apr_cvs; @@ -6800,9 +6801,15 @@ static int32_t qdsp_cvs_callback(struct apr_client_data *data, void *priv) VSS_ISTREAM_EVT_OOB_NOTIFY_ENC_BUFFER_CONSUMED; cvs_voc_pkt = v->shmem_info.sh_buf.buf[1].data; + + if (__unsigned_add_overflow(cvs_voc_pkt[2], + (uint32_t)(3 * sizeof(uint32_t)), &tot_buf_sz)) { + pr_err("%s: integer overflow detected\n", __func__); + return -EINVAL; + } + if (cvs_voc_pkt != NULL && common.mvs_info.ul_cb != NULL) { - if (v->shmem_info.sh_buf.buf[1].size < - ((3 * sizeof(uint32_t)) + cvs_voc_pkt[2])) { + if (v->shmem_info.sh_buf.buf[1].size < tot_buf_sz) { pr_err("%s: invalid voc pkt size\n", __func__); return -EINVAL; } |