evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: fix possible overflow errors in panel_debug_base_reg_read

Browse source 
The panel_reg_buf is a dynamically allocated buffer of size reg_buf_len
so checking sizeof(panel_reg_buf) is incorrect.  Using scnprintf will
ensure that len is at most reg_buf_len - 1 after all the prints.  This
allows sanity checks to be removed which were incorrectly skipping
clock disable, resulting in an extra clock reference count.

Change-Id: Ic3bb685c7b83eefef7bc207ad93d6a2a9e36fd33
Signed-off-by: Patrick Auchter <auchter@motorola.com>
Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
(cherry picked from commit 89bede0751357bc24701b8ebfe326d3e6bb46683)
This commit is contained in:
Patrick Auchter 2016-05-17 16:50:45 -07:00 • committed by Harsh Sahu
parent 0e5b65737d
commit 66221ce8c2
1 changed files with 4 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/video/fbdev/msm/mdss_debug.c
View file

@ -244,23 +244,19 @@ static ssize_t panel_debug_base_reg_read(struct file *file,
mdss_dsi_panel_cmd_read(ctrl_pdata, panel_reg[0], panel_reg[1], mdss_dsi_panel_cmd_read(ctrl_pdata, panel_reg[0], panel_reg[1],
NULL, rx_buf, dbg->cnt); NULL, rx_buf, dbg->cnt);
len = snprintf(panel_reg_buf, reg_buf_len, "0x%02zx: ", dbg->off); len = scnprintf(panel_reg_buf, reg_buf_len, "0x%02zx: ", dbg->off);
if (len < 0)
goto read_reg_fail;
for (i = 0; (len < reg_buf_len) && (i < ctrl_pdata->rx_len); i++) for (i = 0; (len < reg_buf_len) && (i < ctrl_pdata->rx_len); i++)
len += scnprintf(panel_reg_buf + len, reg_buf_len - len, len += scnprintf(panel_reg_buf + len, reg_buf_len - len,
"0x%02x ", rx_buf[i]); "0x%02x ", rx_buf[i]);
if (len)
panel_reg_buf[len - 1] = '\n'; panel_reg_buf[len - 1] = '\n';
if (mdata->debug_inf.debug_enable_clock) if (mdata->debug_inf.debug_enable_clock)
mdata->debug_inf.debug_enable_clock(0); mdata->debug_inf.debug_enable_clock(0);
if (len < 0 || len >= sizeof(panel_reg_buf)) if ((count < reg_buf_len)
return 0;
if ((count < sizeof(panel_reg_buf))
|| (copy_to_user(user_buf, panel_reg_buf, len))) || (copy_to_user(user_buf, panel_reg_buf, len)))
goto read_reg_fail; goto read_reg_fail;