evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: mdss: Add plane_count limit check for mdss_rotator buffer"

Browse source
This commit is contained in:
Linux Build Service Account 2017-05-04 08:45:10 -07:00 • committed by Gerrit - the friendly Code Review server
commit af19d5218d
1 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
drivers/video/fbdev/msm/mdss_rotator.c
View file

@ -501,6 +501,12 @@ static int mdss_rotator_import_buffer(struct mdp_layer_buffer *buffer,
memset(planes, 0, sizeof(planes)); memset(planes, 0, sizeof(planes));
if (buffer->plane_count > MAX_PLANES) {
pr_err("buffer plane_count exceeds MAX_PLANES limit:%d\n",
buffer->plane_count);
return -EINVAL;
}
for (i = 0; i < buffer->plane_count; i++) { for (i = 0; i < buffer->plane_count; i++) {
planes[i].memory_id = buffer->planes[i].fd; planes[i].memory_id = buffer->planes[i].fd;
planes[i].offset = buffer->planes[i].offset; planes[i].offset = buffer->planes[i].offset;
@ -2104,6 +2110,20 @@ struct mdss_rot_entry_container *mdss_rotator_req_init(
struct mdss_rot_entry_container *req; struct mdss_rot_entry_container *req;
int size, i; int size, i;
/*
* Check input and output plane_count from each given item
* are within the MAX_PLANES limit
*/
for (i = 0 ; i < count; i++) {
if ((items[i].input.plane_count > MAX_PLANES) ||
(items[i].output.plane_count > MAX_PLANES)) {
pr_err("Input/Output plane_count exceeds MAX_PLANES limit, input:%d, output:%d\n",
items[i].input.plane_count,
items[i].output.plane_count);
return ERR_PTR(-EINVAL);
}
}
size = sizeof(struct mdss_rot_entry_container); size = sizeof(struct mdss_rot_entry_container);
size += sizeof(struct mdss_rot_entry) * count; size += sizeof(struct mdss_rot_entry) * count;
req = devm_kzalloc(&mgr->pdev->dev, size, GFP_KERNEL); req = devm_kzalloc(&mgr->pdev->dev, size, GFP_KERNEL);