evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fbdev: msm: check for target supports dest scaler

Browse source 
user space can send commit message with dest scaler structure populated,
this would cause null pointer access, if dest scaler is not initialized,
this change validate if target supports dest scaler.

Change-Id: I37516f4704a013d4628688930783d6e7ab93277f
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
This commit is contained in:
raghavendra ambadas 2019-07-01 16:23:36 +05:30
parent 3ae0451881
commit 0bf1f85ad6
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/video/fbdev/msm/mdss_fb.c
View file

@ -1,7 +1,7 @@
/*
* Core MDSS framebuffer driver.
*
* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved.
* Copyright (c) 2008-2019, The Linux Foundation. All rights reserved.
* Copyright (C) 2007 Google Incorporated
*
* This software is licensed under the terms of the GNU General Public
@ -4662,6 +4662,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info,
struct mdp_destination_scaler_data __user *ds_data_user;
struct msm_fb_data_type *mfd;
struct mdss_overlay_private *mdp5_data = NULL;
struct mdss_data_type *mdata;
ret = copy_from_user(&commit, argp, sizeof(struct mdp_layer_commit));
if (ret) {
@ -4764,6 +4765,13 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info,
ds_data_user = commit.commit_v1.dest_scaler;
if ((ds_data_user) &&
(commit.commit_v1.dest_scaler_cnt)) {
mdata = mfd_to_mdata(mfd);
if (!mdata || !mdata->scaler_off ||
!mdata->scaler_off->has_dest_scaler) {
pr_err("dest scaler not supported\n");
ret = -EPERM;
goto err;
}
ret = __mdss_fb_copy_destscaler_data(info, &commit);
if (ret) {
pr_err("copy dest scaler failed\n");