0009-mali-Fix-user-memory-domain-fault.patch

From 03571020539246015470c2e3e8d12be1f80d4934 Mon Sep 17 00:00:00 2001
From: Thibaud Cornic <thibaud_cornic@sigmadesigns.com>
Date: Tue, 9 May 2017 15:28:40 +0200
Subject: [PATCH] mali: Fix user memory domain fault

The current code accesses user memory buffers directly without calling the
proper memory accessors.

Since 4.3, this will trigger a domain fault if CPU_SW_DOMAIN_PAN is
enabled, which will result in a crash and will prevent the driver from
being used.

This is due to some parameters accesses in the driver that do not use the
copied-from-user structure, but the __user one passed as an argument. Fix
those accesses.

Signed-off-by: Thibaud Cornic <thibaud_cornic@sigmadesigns.com>
Signed-off-by: Marc Gonzalez <marc_gonzalez@sigmadesigns.com>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
---
 src/devicedrv/mali/common/mali_gp_job.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/devicedrv/mali/common/mali_gp_job.c b/src/devicedrv/mali/common/mali_gp_job.c
index 8dd19cb2df09..fb8dcd8292e1 100755
--- a/src/devicedrv/mali/common/mali_gp_job.c
+++ b/src/devicedrv/mali/common/mali_gp_job.c
@@ -133,7 +133,7 @@ struct mali_gp_job *mali_gp_job_create(struct mali_session_data *session, _mali_
 				goto fail1;
 			}
 
-			memory_list = (u32 __user *)(uintptr_t)uargs->deferred_mem_list;
+			memory_list = (u32 __user *)(uintptr_t)job->uargs.deferred_mem_list;
 
 			if (0 != _mali_osk_copy_from_user(job->varying_list, memory_list, sizeof(u32) * job->uargs.deferred_mem_num)) {
 				MALI_PRINT_ERROR(("Mali GP job: Failed to copy varying list from user space!\n"));
@@ -173,7 +173,7 @@ struct mali_gp_job *mali_gp_job_create(struct mali_session_data *session, _mali_
 				}
 			}
 
-			if (uargs->varying_memsize > MALI_UK_BIG_VARYING_SIZE) {
+			if (job->uargs.varying_memsize > MALI_UK_BIG_VARYING_SIZE) {
 				job->big_job = 1;
 			}
 		}
-- 
2.11.0