evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: dsi: fix slab-out-of-bounds issue

Browse source 
While handling dsi_gen_read_status, status buffer
was xlogging without checking for its max size.
Add proper conditional check to xlog status buffer.

Change-Id: Ia5a1fe18de123d2911c31ae79492b96f67e1273d
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
This commit is contained in:
Narender Ankam 2018-08-30 21:45:59 +05:30 • committed by Gerrit - the friendly Code Review server
parent ea4b9f527e
commit 2827d8bc19
1 changed files with 5 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/video/fbdev/msm/mdss_dsi_panel.c
View file

@ -1803,17 +1803,13 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl)
for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++)
len += lenp[i];
for (i = 0; i < len; i++) {
pr_debug("[%i] return:0x%x status:0x%x\n",
i, (unsigned int)ctrl->return_buf[i],
(unsigned int)ctrl->status_value[j + i]);
MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],
ctrl->status_value[j + i]);
j += len;
}
for (j = 0; j < ctrl->groups; ++j) {
for (i = 0; i < len; ++i) {
pr_debug("[%i] return:0x%x status:0x%x\n",
i, ctrl->return_buf[i],
(unsigned int)ctrl->status_value[group + i]);
MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],
ctrl->status_value[group + i]);
if (ctrl->return_buf[i] !=
ctrl->status_value[group + i])
break;