diff --git a/drivers/video/fbdev/msm/mdss_fb.c b/drivers/video/fbdev/msm/mdss_fb.c index 1b408e2838d6..f56e50d516cd 100644 --- a/drivers/video/fbdev/msm/mdss_fb.c +++ b/drivers/video/fbdev/msm/mdss_fb.c @@ -1,7 +1,7 @@ /* * Core MDSS framebuffer driver. * - * Copyright (c) 2008-2018, The Linux Foundation. All rights reserved. + * Copyright (c) 2008-2019, The Linux Foundation. All rights reserved. * Copyright (C) 2007 Google Incorporated * * This software is licensed under the terms of the GNU General Public @@ -4662,6 +4662,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, struct mdp_destination_scaler_data __user *ds_data_user; struct msm_fb_data_type *mfd; struct mdss_overlay_private *mdp5_data = NULL; + struct mdss_data_type *mdata; ret = copy_from_user(&commit, argp, sizeof(struct mdp_layer_commit)); if (ret) { @@ -4764,6 +4765,13 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, ds_data_user = commit.commit_v1.dest_scaler; if ((ds_data_user) && (commit.commit_v1.dest_scaler_cnt)) { + mdata = mfd_to_mdata(mfd); + if (!mdata || !mdata->scaler_off || + !mdata->scaler_off->has_dest_scaler) { + pr_err("dest scaler not supported\n"); + ret = -EPERM; + goto err; + } ret = __mdss_fb_copy_destscaler_data(info, &commit); if (ret) { pr_err("copy dest scaler failed\n");