Commit graph

568387 commits

Author SHA1 Message Date
Devesh Jhunjhunwala
467b64b1c5 clk: msm: Add support to control MEM_PERPIH_OFF bit of branch clock
Update cbcr_set_flags method to add support for controlling the
MEM_PERPIH_OFF bit for branch clocks.

Change-Id: I87451b02cb9000dc850fdfaa52a5a9f9fd2893a1
Signed-off-by: Devesh Jhunjhunwala <deveshj@codeaurora.org>
2016-03-23 21:15:36 -07:00
Karthikeyan Ramasubramanian
243a901e21 soc: qcom: glink: Signal the waiter for rx_intent ack under error
During subsystem restart, if a transmit operation is waiting for a remote
receive intent acknowledgment, signal the waiter that the receive intent
request will not be acknowledged. Also check the transport and channel
state before waiting for the acknowledgment. This will prevent the
transmit operation from blocking indefinitely under error scenario.

CRs-Fixed: 952184
Change-Id: I29b8215841f7dcca52137f451665eaf339a6f78e
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
2016-03-23 21:15:35 -07:00
Bhalchandra Gajare
d9ac385da9 ASoC: wcd_cpe_core: Perform irq cleanup once the bus is up
During subsystem restart, it is possible that while the underlying bus
is down, the irq driver has already performed its cleanup. In such case,
when CPE driver requests to cleanup its own irq, the irq driver attempts
to hold an lock that is already freed. Fix this issue by performing the
CPE driver irq cleanup after bus is up rather than when bus is down.

CRs-fixed: 948899
Change-Id: I2772e89bbdc855baa9fcf7a34a9c16f2f5c05c32
Signed-off-by: Bhalchandra Gajare <gajare@codeaurora.org>
2016-03-23 21:15:34 -07:00
Lorenzo Colitti
a24486df0d net: tcp: check for SOCK_DEAD again in tcp_nuke_addr
Liping Zhang spotted a race between tcp_nuke_addr and tcp_close
that can cause a crash. If a userspace process calls tcp_close
on a socket at the same time that tcp_nuke_addr is closing it,
and tcp_close wins the race to call lock_sock, it will call
sock_orphan before releasing the lock. sock_orphan sets the
SOCK_DEAD flag on the socket and proceeds to close it, eventually
calling inet_csk_destroy_sock. When tcp_nuke_addr gets the socket
lock, it calls tcp_done. But if tcp_done sees the SOCK_DEAD flag,
it calls inet_csk_destroy_sock as well, resulting in a double
free.

Fix this by checking for SOCK_DEAD again after lock_sock
succeeds. Eric had already pointed out that this could be a
problem in b/23663111, so there was already a TODO in the code
for this.

Change-Id: I0c87c3fd0598384d957b69734366bd4e2fd7e8d7
Git-commit: 61469ddc534f255c709349a1a611216ecd07e13d
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
2016-03-23 21:15:33 -07:00
Lorenzo Colitti
21af70100c Fix NULL pointer dereference in tcp_nuke_addr.
tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.

Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Git-commit: 74d66ee756afcc3269e4c1341f793c52be629af9
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
2016-03-23 21:15:32 -07:00
Peter Liu
f10ced0ba5 msm: camera: isp: fix error report id mask
Stream id mask need more than 8 bit,
thus increase bit width for error reporting.

Change-Id: I308a9d3df6024768b07ec49562f3241707566e2a
Signed-off-by: Peter Liu <pingchie@codeaurora.org>
2016-03-23 21:15:31 -07:00
vivek mehta
092ca0fe36 ASoC: msm: send gain info for all channels mask
- currently gain is added for only number of channels and clip
  channel count is send to dsp.
- but it is possible that channel mask that driver has is different
  than what dsp discovers after decoding the codec config data
- volume will not be applied to channels that differ between driver
  and dsp and device volume will not apply on these channels
- change is to control multi-channel volume using master gain

Change-Id: Icd8ca4e935d9095dd9ef8b65eff34629326fb563
Signed-off-by: vivek mehta <mvivek@codeaurora.org>
2016-03-23 21:15:30 -07:00
Ben Romberger
be8713afec ASoC: msm: qdsp6v2: Move asm list init before apr registration
Move list init for no wait que before apr registration.
If apr registration fails asm free client will free
the no wait que.

Change-Id: I4707dbf4771a1ec313898adb2284c06ef1fb5b3a
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
2016-03-23 21:15:30 -07:00
Terence Ho
085abf8aee msm: camera: Fix to enable RDI2
Fix incorrect comparison that prevented RDI2 from being enabled.

Change-Id: I4f18a290237f074b6a095d33dcd8429f90c8a1d5
Signed-off-by: Terence Ho <terenceh@codeaurora.org>
2016-03-23 21:15:29 -07:00
Ram Chandrasekar
4f9f3cdabf msm: limits: Add support to handle data greater than PAGE_SIZE
Debug data read was not handling the buffer overflow case when
the data to write is greater than PAGE_SIZE. This resulted in
calling the hardware for new data multiple times.

Returning success when buffer overflowed will cause the sequence
traverse function to call again with a new buffer with increased
size. This process will go on until the buffer size is big enough
to hold the data. But limits data read function couldn't distinguish
if the call is a retry or a new call and will initiate a new data
fetch from hardware and re-populate with new data.

Modify debug read interface to immediately return success when
overflow happens. The debug read function now can distinguish between
a sequence retry call by retaining the data buffer in a static if
overflow happens. When called again, debug read now will avoid
calling the hardware for new data and instead will populate the new
sequence buffer with the previously fetched data.

Change-Id: Icc0eb035047ab734d2eb5366cade4ec187747379
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2016-03-23 21:15:28 -07:00
Ram Chandrasekar
ff6a8d7123 msm: lmh_lite: Remove primary interrupt handler
The primary interrupt handler disables the lmh interrupt. But
this is already taken care by IRQF_ONESHOT flag. Remove
the primary interrupt handler and disable the interrupt in the
interrupt thread function.

Change-Id: I6c607e0cdef09ffe4f758f9498ee6241d099ee26
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2016-03-23 21:15:27 -07:00
Ram Chandrasekar
1271a44387 msm: limits: update the snprintf error handling
Update the snprintf() error handling in the
available_level_get() function to look for proper error
return value and take appropriate action.

Change-Id: Ifbe6450693a282105d9fddd02a756ae53d8cd892
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2016-03-23 21:15:26 -07:00
Ram Chandrasekar
5c6e81fff6 msm: lmh_lite: Fix configurability for LMH software polling
Update the lmh hardware driver to get the polling interval
value from the lmh interface driver, instead of using a local
static variable.

LMH interface driver already exposes debug interface to
configure the interval value.

Change-Id: Ie7d91519f197930ca513b30a671d8f6917d636b0
Signed-off-by: Ram Chandrasekar <rkumbako@codeaurora.org>
2016-03-23 21:15:25 -07:00
Ghanim Fodi
f5184f638f msm: ipa3: Configure IPA RX HPS resources distribution
IPA RX HPS command queue resources need to be distributed
among the different resource groups (e.g. Uplink group).
The configuration is the maximum and minimum number of
resources that can be used by each group.

Change-Id: I02cf831b6ea6da812b67624fbb48bb829e4684d3
Signed-off-by: Ghanim Fodi <gfodi@codeaurora.org>
2016-03-23 21:15:24 -07:00
Suman Tatiraju
6a1704d165 msm: kgsl: Fix direct references to HZ
Make the various timeout values HZ agnostic by using the proper
macros and values instead.

Change-Id: I708cd491f593782f0172cd7d2cca058cd41044a5
Signed-off-by: Suman Tatiraju <sumant@codeaurora.org>
2016-03-23 21:15:24 -07:00
Maulik Shah
505dc37e5b defconfig: msm: Enable APSS_CORE_EA config for ARM32 and ARM64 systems
Enable energy-awareness driver for msmtitanium.

Change-Id: I875fe8c4ae5d84a6ac8311bcc64eca509d689b16
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
2016-03-23 21:15:23 -07:00
Susheel Khiani
ece4a53416 dma-mapping: Check for valid IOVA address
We might fail in alloc_iova if we run out
of virtual addresses in pool. Currently,
if we fail in alloc_iova we are not checking
for return value and directly going ahead
and mapping invalid IOVA address. Fix this
by explicitly checking for return value
from alloc_iova.

Change-Id: I7681d13b75f47a86f0b0b6cbf4b8405a7528ff66
Signed-off-by: Susheel Khiani <skhiani@codeaurora.org>
2016-03-23 21:15:22 -07:00
Sarada Prasanna Garnayak
06ae5fe9fc net: wireless: decouple cnss crypto from cnss memory pre-alloc
The cnss crypto add support for wlan host driver for security
Protocol and cipher key generation where cnss memory pre-alloc
feature enable wlan driver to use pre allocated memory
for its internal usage and release it to back to pre-allocated pool.

Decouple cnss crypto from cnss memory pre-alloc and add kernel
config flag for this  crypto module compilation and update
the defocnfig of required targets.

CRs-Fixed: 949992
Change-Id: If34819fd76076ba522a9a42ac41fdae1f541f5c8
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
2016-03-23 21:15:21 -07:00
Vinayak Menon
4d09f895a3 mm: zcache: clear zcache when low on file pages
When files pages are very low, it is better to clear off
zcache pages, since the freed memory can be used to sustain
an application in foreground. Moreover when file pages
are too low, we don't gain much by holding a few zcache
pages.

Change-Id: I88dd295d24b7de18fb3bc0788e0baeb6bfdb2f6d
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:20 -07:00
Vinayak Menon
90a22ec53a mm: zcache: add zero page support
zero pages need not be compressed and stored unnecessarily.
Rather insert a special handle to the radix tree to identify
a zero page.

Change-Id: Ic92321c4753401a90d69a6e8c61b5119168c9df7
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:19 -07:00
Vinayak Menon
6fe144923f radix-tree: add radix_tree_gang_lookup_index
Add radix_tree_gang_lookup_index to get the radix tree
indices along with the pointers. This will be  helpful,
for e.g. if a radix_tree_delete has to be performed
depending on one of the result values.

Change-Id: Iab83d027968462aa30da5341fa3f60134b6c1137
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:18 -07:00
Vinayak Menon
347c419ead mm: zcache: do not wake up kswapd for zcache allocs
zcache allocations happen during reclaim of pages,
and waking up kswapd at this time hinders system
performance. During tests it was seen that without
this patch, there were a lot of kswapd wakeups and
was resulting in bad launches.

Change-Id: Ic0f0240b8fdad6b3fe142b2bdc0366cfd870635e
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:17 -07:00
Vinayak Menon
5ef8272721 mm: zcache: fix accouting of pool pages
zcache_pool_pages is supposed to store the total
pages in all the pools used by zcache. But at
present zcache_pool_pages is assigned pages of any
particular pool on a load, store or any operation
which modifies the pool size. And this is more
important for external clients which depend on zcache
pool size, like the lowmemorykiller.

Change-Id: Ifdaab8646c40f1fec71dfa5903658fbdc6b3cce5
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:17 -07:00
Vinayak Menon
aefb461740 mm: zcache: shrink zcache on memory pressure
When file pages drops down, at a point zcache pages
can be more than the file pages, and even further when
we have to reclaim the maximum number of file pages
possible to launch an application, we need a way to
reclaim even the zcache pages at least to an extend
which makes it match with the number of file pages.
This can help in better foreground headroom.

Change-Id: I481bfb9961ed5cee47ebeae08eb910bb269b644c
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:16 -07:00
Vinayak Menon
42bfd5ca64 mm: zcache: disallow sleep in zcache store
zcache store ops cannot sleep since it is called from
an atomic context. Pass the right flags to alloc functions.

Change-Id: I9c7956e895fb7909932315aa3d85845127aa02e1
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2016-03-23 21:15:15 -07:00
Bob Liu
37b371fd53 mm: zcache: add evict zpages supporting
Implemented zbud_ops->evict, so that compressed zpages can be evicted from
zbud memory pool in the case that the compressed pool is full.

zbud already managered the compressed pool based on LRU. The evict was
implemented just by dropping the compressed file page data directly, if
the data is required again then no more disk reading can be saved.

Signed-off-by: Bob Liu <bob.liu@oracle.com>
Patch-mainline: linux-mm @ 2013-08-06 11:36:16
[vinmenon@codeaurora.org: trivial merge conflict fixes]
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Change-Id: Ia66652475e490f0233547511e80abf7587054e65
2016-03-23 21:15:14 -07:00
Bob Liu
c3ca4b603e mm: zcache: add core files
zcache is a backend for cleancache that takes file pages that are in the
process of being reclaimed and attempts to compress them and store them
in a RAM-based memory pool. This can result in a significant I/O reduction
if system is full with file pages and, in the case where decompressing
from RAM is faster than reading from the disk, can also improve workload
performance.

Signed-off-by: Bob Liu <bob.liu@oracle.com>
Patch-mainline: linux-mm @ 2013-08-06 11:36:14
[vinmenon@codeaurora.org: trivial merge conflict fixes, checkpatch fixes]
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Change-Id: Id05bcc1946eee22b94a83adeb0134a3f6e357ef8
2016-03-23 21:15:13 -07:00
Walter Yang
afbbca6a77 ASoC: wcd_cpe_services: delete the redundant worker thread
Currently worker thread in cpe service is created twice.
The second thread handler overwrites the first one. The first
thread is not freed  when the service is cleaned up. The fix
prevents creation of the redundant thread.

CRs-Fixed: 949165
Change-Id: Idd76b76d4f7f25d2592ca7c336dbee77b6efc7eb
Signed-off-by: Walter Yang <yandongy@codeaurora.org>
2016-03-23 21:15:12 -07:00
Alex Yakavenka
de0b2b9dd0 can: Add RH850 CAN controller driver
This driver creates network device of type CAN
and processes tx and rx frames that it sends and
receives over SPI.

Change-Id: I903927d5bb0025c2ad3e9f1dd7cb51de547fc360
Signed-off-by: Alex Yakavenka <ayakav@codeaurora.org>
2016-03-23 21:15:11 -07:00
Steven Cahail
d9ad69783b trace: ipc_logging: Increase maximum size of logging context name
The current maximum length of an IPC Logging log context name is 20
characters. Some clients are now using names longer than this.

Increase the maximum length to 32. This change increases the IPC Logging
version to 3.

Change-Id: I9daecb8a7c6c3aea427efd1c75e307456e9c6c21
Signed-off-by: Steven Cahail <scahail@codeaurora.org>
2016-03-23 21:15:11 -07:00
Yan He
fedf20a070 msm: sps: support using cached write pointer for BAM-to-Sys mode
Support using the cached write pointer for a BAM-to-Sys mode BAM
pipe when check if the desc FIFO of that pipe is full.

Change-Id: Ie480ecca9eff76388c504665b496e01bbf3e009f
Signed-off-by: Yan He <yanhe@codeaurora.org>
2016-03-23 21:15:10 -07:00
Sudheer Papothi
b12c7d2cd1 soundwire: Add slave synchronization configuration
Slave synchronization is needed to sync frame shape consisting
of different ports with different sample rates. Change sets
the slave synchronization based on the frame shape.

Change-Id: Iae726555b3c158394662c590d1ebc781ff7f54f5
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
2016-03-23 21:15:09 -07:00
Vinu Deokaran
d9a1729d78 ARM: dts: apq: enable dual dsi for agave board for APQ8096
Enable dual DSI for Agave board to support three displays.

Change-Id: I80e0c90e3d039a1777598f4038d9a1d18f23ca1b
Signed-off-by: Vinu Deokaran <vinud@codeaurora.org>
2016-03-23 21:15:08 -07:00
Abhishek Kondaveeti
3b5427bdee msm: isp: Add output format support for camif
Add output format support for camif raw path
in isp.

Change-Id: If8e633175a5488b8da740654c8204b0247d3c408
Signed-off-by: Abhishek Kondaveeti <akondave@codeaurora.org>
2016-03-23 21:15:07 -07:00
Zhenhua Huang
588f3266eb soc: qcom: socinfo: Add check for subtype id
There's an overflow when subtype id is greater than 3 in current
design. Add a check to ensure returning correct value.

Change-Id: Ie8d234792f7370c95782a86e16affd383ed53c18
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
2016-03-23 21:15:06 -07:00
Sudheer Papothi
ec61fa0e6f ARM: dts: msm: Add pinctrl for codec reset and interrupt on 8996
Change reset and interrupt lines of codec from gpio to pinctrl
on 8996 target to control the drive strength of the pins.

Change-Id: Ie95b80699f1726c2b2e27c1b8e5f51f7ccdd5417
Signed-off-by: Sudheer Papothi <spapothi@codeaurora.org>
2016-03-23 21:15:05 -07:00
Karthikeyan Ramasubramanian
6abda44581 soc: qcom: glink: Fix race condition between tx and close operation
The channel is closed locally by the client either as part of SSR or normal
working scenario. The transmit operation does not check the transport or
channel states before queuing the packet for transmit operation. This
causes the transmit operation to access stale transport or channel context.

Check the transport and channel state before queuing the packet for
transmission.

CRs-Fixed: 947627
Change-Id: Ic6f8350b6b5e51b641794255f8520ff4616343bb
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
2016-03-23 21:15:04 -07:00
Steven Cahail
d3bc56a0d1 trace: ipc_logging: Destroy debugfs directories with logging contexts
IPC Logging currently creates debugfs directories for each of its
logging contexts, but does not remove them when destroying the contexts.
If a user attempts to access a directory associated with a destroyed
context, a crash will result.

Destroy debugfs directories when the logging context is destroyed.

Change-Id: I5a3b1cbf2fb5d9d0ede3d9da0fccd605b9fdf619
Signed-off-by: Steven Cahail <scahail@codeaurora.org>
2016-03-23 21:15:04 -07:00
Dhaval Patel
4cc2cc8fc3 ARM: dts: msm: enable bta check for nt35597 panel on msm8996
Enable bta check for nt35597 dual dsi/single dsi(dsc) and
video/command mode panel on msm8996 target.

Change-Id: I0a4dd466719f973690f996e7a0cbe95de9b88ad7
Signed-off-by: Dhaval Patel <pdhaval@codeaurora.org>
2016-03-23 21:15:03 -07:00
Ingrid Gallardo
b136fcc3c4 Revert "ARM: dts: msm: Enable dynamic refresh for sharp WQXGA panel"
This reverts commit 9d9fb803fd88c493bd27f7b3af21358f8b16bfe2
("ARM: dts: msm: Enable dynamic refresh for sharp WQXGA panel")
since the dynamic refresh  method enabled by the change is
causing random touch events to be triggered.

Change-Id: Ibfab4827c53635bd8c399b087a9a699f26c69dbc
Signed-off-by: Ingrid Gallardo <ingridg@codeaurora.org>
2016-03-23 21:15:02 -07:00
Ravinder Konka
90f5ff1935 netfilter: Fix to MT call issue
Changes to store forced port only in the original direction.
This resolves the MT call issue where destination port is
incorrectly translated to forced_port.

Change-Id: I1b1c407c4beb8185ada0b005b1cd1034cb975141
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
2016-03-23 21:15:01 -07:00
Jack Pham
ea8b061e0d ARM: dts: msm: Remove obsolete USB 'power-collapse' properties
These properties are no longer used and can be removed.

Change-Id: Iea376798a6a9da5ba5a0a6fa4e24c15c1cfe188d
Signed-off-by: Jack Pham <jackp@codeaurora.org>
2016-03-23 21:15:00 -07:00
Jack Pham
73b8a7c107 clk: msm: clock-gcc-8996: Add USB_20_BCR
Add the BCR to reset USB20 block to gcc_usb20_master_clk. This will
allow the driver to correctly call clk_reset().

Change-Id: Ib4f8b73317032c88f5272a530007ff08d14dbd4a
Signed-off-by: Jack Pham <jackp@codeaurora.org>
2016-03-23 21:14:59 -07:00
Zhen Kong
80a9c6a26b qseecom: Add a new smc cmd to check RPMB key provision status
A new smc cmd is added to check RPMB key provision status

Change-Id: I50411bf9ae7f31589be34d7b5aaf48f2c12f0018
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-23 21:14:58 -07:00
Phani Kumar Uppalapati
5c2bb64a1c ASoC: wcd9335: Change RX disconnect port sequence
Change RX disconnect port sequence so as to avoid
slimbus underflow and audio mute issues during
playback.

Change-Id: I0260e61b78e3bcfe422896dc60b15af84be424a4
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
2016-03-23 21:14:58 -07:00
Banajit Goswami
d2c515c358 ASoC: wcd9335: update default VBat Bias current
Update default value for VBat Bias current for Front-end.
The increase in current value is needed to increase
robustness of VBat ADC output when the feature is used
at low temparature.

Change-Id: Ic924fa59ce867f9b32c17564f8f55406c6c467ea
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
2016-03-23 21:14:57 -07:00
Phani Kumar Uppalapati
dc9d51cfe2 ASoC: msm: Enable MBHC 5-pole plug detection
Enable MBHC (Multi Button Headset Control) 5-pole
plug detection so as to detect the presence of
second microphone whenever any accessory is inserted
in to the headset jack.

Change-Id: I53dda0d18006109c19a1cd8ce0bc4df45a13f0bf
Signed-off-by: Phani Kumar Uppalapati <phaniu@codeaurora.org>
2016-03-23 21:14:56 -07:00
Karthikeyan Ramasubramanian
a203482481 soc: qcom: ipc_router_glink_xprt: Fix receive callback
G-Link driver notifies IPC Router about receive events in atomic context.
Allocate the memory from atomic pool to cache the information about rx
events for deferred processing.

CRs-Fixed: 948393
Change-Id: I09fb7ffd38b5a36b9ef99b6adb76c7e1f0168457
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
2016-03-23 21:14:55 -07:00
Osvaldo Banuelos
4a26a83ecc ARM: dts: msm: Disable VDD_APCC ACC regulator devices for msm8996v2
Disable the regulator devices which manage ACC settings for
memories powered by VDD_APCC in the CPUSS. In addition, update
the CPR3 controller and regulator devices which manage VDD_APCC
to ensure CPR corner changes do not result in configuring ACC
regulators.

Change-Id: Ib176c762d12e996e809ee0ccf0bc56d5ae37c0f3
Signed-off-by: Osvaldo Banuelos <osvaldob@codeaurora.org>
2016-03-23 21:14:54 -07:00
Rajesh Kemisetti
b9ad61fb8e msm: kgsl: Add missing check for size against lower VA
_get_unmapped_area_topdown() subtracts the requested size
from lower entry base without really checking its value.

This leads to overflow while working at boundary conditions.

Add a condition to check entry base with the size and proceed.

Change-Id: Ic695da683b11de35c7c4b8936a35d693dc8fa452
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
2016-03-23 21:14:53 -07:00