msm: kgsl: Enhance reading lm_sequence in _execute_reg_sequence()

Modified conditional checks to read lm_sequence so as to avoid
the possibility of pointer overflow.

CRs-Fixed: 2212443
Change-Id: I72b30e35996c40f23fc81739e27724b1188f1c05
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>

diff --git a/drivers/gpu/msm/adreno_a5xx.c b/drivers/gpu/msm/adreno_a5xx.c
index 119741f..4daf1fa 100644 (file)
--- a/drivers/gpu/msm/adreno_a5xx.c
+++ b/drivers/gpu/msm/adreno_a5xx.c
@@ -1381,13 +1381,13 @@ static int _execute_reg_sequence(struct adreno_device *adreno_dev,
 
        /* todo double check the reg writes */
        while ((cur - opcode) < length) {
-               if (cur[0] == 1 && ((cur + 4) - opcode) <= length) {
+               if (cur[0] == 1 && (length - (cur - opcode) >= 4)) {
                        /* Write a 32 bit value to a 64 bit reg */
                        reg = cur[2];
                        reg = (reg << 32) | cur[1];
                        kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, cur[3]);
                        cur += 4;
-               } else if (cur[0] == 2 && ((cur + 5) - opcode) <= length) {
+               } else if (cur[0] == 2 && (length - (cur - opcode) >= 5)) {
                        /* Write a 64 bit value to a 64 bit reg */
                        reg = cur[2];
                        reg = (reg << 32) | cur[1];
@@ -1395,7 +1395,7 @@ static int _execute_reg_sequence(struct adreno_device *adreno_dev,
                        val = (val << 32) | cur[3];
                        kgsl_regwrite(KGSL_DEVICE(adreno_dev), reg, val);
                        cur += 5;
-               } else if (cur[0] == 3 && ((cur + 2) - opcode) <= length) {
+               } else if (cur[0] == 3 && (length - (cur - opcode) >= 2)) {
                        /* Delay for X usec */
                        udelay(cur[1]);
                        cur += 2;