summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPixelBot AutoMerger <android-nexus-securitybot@system.gserviceaccount.com>2021-11-21 20:31:57 -0800
committerRoger Liao <rogerliao@google.com>2021-11-24 04:29:47 +0000
commitb84f8e52e2b4a415b52adfffc818e81d0ef243b7 (patch)
treea35d2ca0b73f1f081f3687c540ce6e18c7e2f439
parent030a0315a57274fe14047ae53fbd79e0a3c2ad92 (diff)
parent3eaeb3d1cb43c30b3535c85ee85570c61d0a00fa (diff)
downloadgpu-android-gs-raviole-5.10-android12L.tar.gz
Bug: 199698959 SBMerger: 410055097 Change-Id: Ia0c43810d3e32d32d64ba8d22236bb66dbe5fe29 Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
-rw-r--r--mali_pixel/memory_group_manager.c14
1 files changed, 14 insertions, 0 deletions
diff --git a/mali_pixel/memory_group_manager.c b/mali_pixel/memory_group_manager.c
index d057148..5c98a5d 100644
--- a/mali_pixel/memory_group_manager.c
+++ b/mali_pixel/memory_group_manager.c
@@ -94,6 +94,7 @@ struct mgm_group {
* struct mgm_groups - Structure for groups of memory group manager
*
* @groups: To keep track of the number of allocated pages of all groups
+ * @ngroups: Number of groups actually used
* @dev: device attached
* @pt_handle: Link to SLC partition data
* @kobj: &sruct kobject used for linking to pixel_stats_sysfs node
@@ -104,6 +105,7 @@ struct mgm_group {
*/
struct mgm_groups {
struct mgm_group groups[MEMORY_GROUP_MANAGER_NR_GROUPS];
+ size_t ngroups;
struct device *dev;
struct pt_handle *pt_handle;
struct kobject kobj;
@@ -397,6 +399,10 @@ static struct page *mgm_alloc_page(
if (INVALID_GROUP_ID(group_id))
return NULL;
+ if (WARN_ON_ONCE((group_id != MGM_RESERVED_GROUP_ID) &&
+ (GROUP_ID_TO_PT_IDX(group_id) >= data->ngroups)))
+ return NULL;
+
/* We don't expect to be allocting pages into the group used for
* external or imported memory
*/
@@ -596,6 +602,14 @@ static int mgm_initialize_data(struct mgm_groups *mgm_data)
{
int i, ret;
+ const int ngroups = of_property_count_strings(mgm_data->dev->of_node, "pt_id");
+ if (WARN_ON(ngroups < 0) ||
+ WARN_ON(ngroups > MEMORY_GROUP_MANAGER_NR_GROUPS)) {
+ mgm_data->ngroups = 0;
+ } else {
+ mgm_data->ngroups = ngroups;
+ }
+
for (i = 0; i < MEMORY_GROUP_MANAGER_NR_GROUPS; i++) {
atomic_set(&mgm_data->groups[i].size, 0);
atomic_set(&mgm_data->groups[i].lp_size, 0);