3 files changed, 21 insertions, 9 deletions

diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index a18126150e11..14ff87686a36 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -213,7 +213,14 @@ void adreno_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
 void adreno_flush(struct msm_gpu *gpu)
 {
         struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-        uint32_t wptr = get_wptr(gpu->rb);
+        uint32_t wptr;
+
+        /*
+         * Mask wptr value that we calculate to fit in the HW range. This is
+         * to account for the possibility that the last command fit exactly into
+         * the ringbuffer and rb->next hasn't wrapped to zero yet
+         */
+        wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1);
 
         /* ensure writes to ringbuffer have hit system memory: */
         mb();
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 166e84e4f0d4..489676568a10 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -106,7 +106,8 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                         pagefault_disable();
                 }
 
-                if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
+                if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) ||
+                        !(submit_bo.flags & MSM_SUBMIT_BO_FLAGS)) {
                         DRM_ERROR("invalid flags: %x\n", submit_bo.flags);
                         ret = -EINVAL;
                         goto out_unlock;
@@ -290,7 +291,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
 {
         uint32_t i, last_offset = 0;
         uint32_t *ptr;
-        int ret;
+        int ret = 0;
 
         if (offset % 4) {
                 DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset);
@@ -318,12 +319,13 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
 
                 ret = copy_from_user(&submit_reloc, userptr, sizeof(submit_reloc));
                 if (ret)
-                        return -EFAULT;
+                        goto out;
 
                 if (submit_reloc.submit_offset % 4) {
                         DRM_ERROR("non-aligned reloc offset: %u\n",
                                         submit_reloc.submit_offset);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
                 }
 
                 /* offset in dwords: */
@@ -332,12 +334,13 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
                 if ((off >= (obj->base.size / 4)) ||
                                 (off < last_offset)) {
                         DRM_ERROR("invalid offset %u at reloc %u\n", off, i);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
                 }
 
                 ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova, &valid);
                 if (ret)
-                        return ret;
+                        goto out;
 
                 if (valid)
                         continue;
@@ -354,9 +357,10 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
                 last_offset = off;
         }
 
+out:
         msm_gem_put_vaddr_locked(&obj->base);
 
-        return 0;
+        return ret;
 }
 
 static void submit_cleanup(struct msm_gem_submit *submit)
diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
index f326cf6a32e6..67b34e069abf 100644
--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
+++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int size)
         struct msm_ringbuffer *ring;
         int ret;
 
-        size = ALIGN(size, 4);   /* size should be dword aligned */
+        if (WARN_ON(!is_power_of_2(size)))
+                return ERR_PTR(-EINVAL);
 
         ring = kzalloc(sizeof(*ring), GFP_KERNEL);
         if (!ring) {