evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm : mdss: Avoid arbitrary free of scale_data in error condition"

Browse source
This commit is contained in:
Linux Build Service Account 2017-02-26 23:48:23 -08:00 • committed by Gerrit - the friendly Code Review server
commit 03c6cbcaf3
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
drivers/video/fbdev/msm/mdss_fb.c
View file

@ -4479,7 +4479,7 @@ err:
static int __mdss_fb_copy_destscaler_data(struct fb_info *info, static int __mdss_fb_copy_destscaler_data(struct fb_info *info,
struct mdp_layer_commit *commit) struct mdp_layer_commit *commit)
{ {
int i; int i = 0;
int ret = 0; int ret = 0;
u32 data_size; u32 data_size;
struct mdp_destination_scaler_data __user *ds_data_user; struct mdp_destination_scaler_data __user *ds_data_user;
@ -4552,6 +4552,7 @@ static int __mdss_fb_copy_destscaler_data(struct fb_info *info,
data_size); data_size);
if (ret) { if (ret) {
pr_err("scale data copy from user failed\n"); pr_err("scale data copy from user failed\n");
kfree(scale_data);
goto err; goto err;
} }
} }
@ -4561,7 +4562,7 @@ static int __mdss_fb_copy_destscaler_data(struct fb_info *info,
err: err:
if (ds_data) { if (ds_data) {
for (i = 0; i < commit->commit_v1.dest_scaler_cnt; i++) { for (i--; i >= 0; i--) {
scale_data = to_user_ptr(ds_data[i].scale); scale_data = to_user_ptr(ds_data[i].scale);
kfree(scale_data); kfree(scale_data);
} }