Merge "msm: kgsl: Verify the user address before reading a perfcounter group"
diff --git a/drivers/gpu/msm/adreno.c b/drivers/gpu/msm/adreno.c
index 9982e1f..e13edd6 100644
--- a/drivers/gpu/msm/adreno.c
+++ b/drivers/gpu/msm/adreno.c
@@ -301,7 +301,7 @@
*/
int adreno_perfcounter_read_group(struct adreno_device *adreno_dev,
- struct kgsl_perfcounter_read_group *reads, unsigned int count)
+ struct kgsl_perfcounter_read_group __user *reads, unsigned int count)
{
struct adreno_perfcounters *counters = adreno_dev->gpudev->perfcounters;
struct adreno_perfcount_group *group;
@@ -320,12 +320,6 @@
if (reads == NULL || count == 0 || count > 100)
return -EINVAL;
- /* verify valid inputs group ids and countables */
- for (i = 0; i < count; i++) {
- if (reads[i].groupid >= counters->group_count)
- return -EINVAL;
- }
-
list = kmalloc(sizeof(struct kgsl_perfcounter_read_group) * count,
GFP_KERNEL);
if (!list)
@@ -339,8 +333,15 @@
/* list iterator */
for (j = 0; j < count; j++) {
+
list[j].value = 0;
+ /* Verify that the group ID is within range */
+ if (list[j].groupid >= counters->group_count) {
+ ret = -EINVAL;
+ goto done;
+ }
+
group = &(counters->groups[list[j].groupid]);
/* group/counter iterator */