Commit 5b49a46b authored by Dmitry Baryshkov's avatar Dmitry Baryshkov
Browse files

drm/msm/dsi: don't dump registers past the mapped region 



On DSI 6G platforms the IO address space is internally adjusted by
io_offset. Later this adjusted address might be used for memory dumping.
However the size that is used for memory dumping isn't adjusted to
account for the io_offset, leading to the potential access to the
unmapped region. Lower ctrl_size by the io_offset value to prevent
access past the mapped area.

 msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P)
 msm_dsi_host_snapshot+0x4c/0x78 [msm]
 msm_dsi_snapshot+0x28/0x50 [msm]
 msm_disp_snapshot_capture_state+0x74/0x140 [msm]
 msm_disp_snapshot_state_sync+0x60/0x90 [msm]
 _msm_disp_snapshot_work+0x30/0x90 [msm]
 kthread_worker_fn+0xdc/0x460
 kthread+0x120/0x140

Fixes: bac2c6a6 ("drm/msm: get rid of msm_iomap_size")
Signed-off-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: default avatarKonrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/721747/
Link: https://lore.kernel.org/r/20260428-msm-fix-dsi-dump-v1-1-5d4cb5ccfac7@oss.qualcomm.com
parent d03279f0

drivers/gpu/drm/msm/dsi/dsi_host.c

+1 −0
Original line number Diff line number Diff line
@@ -2033,6 +2033,7 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi) 


	/* fixup base address by io offset */

	msm_host->ctrl_base += cfg->io_offset;

	msm_host->ctrl_size -= cfg->io_offset;



	ret = devm_regulator_bulk_get_const(&pdev->dev, cfg->num_regulators,

					    cfg->regulator_data,