evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: Copy only error code back to userspace after atomic commit

Browse source 
Previously, the atomic commit ioctl copies the entire kernel layer list
to the userspace layer list structure. The only parameter modified
during atomic commit should be the error code, and therefore, the
only value needed by userspace after the atomic commit ioctl returns.
Copying the kernel layer list structure causes the userspace to have
stale kernel pointer references to scale and PP info structures.

Change-Id: Ia8e96af21f7d9594a47d1503f3afef50a767971f
Signed-off-by: Benet Clark <benetc@codeaurora.org>
This commit is contained in:
Benet Clark 2015-06-04 18:25:09 -07:00 • committed by David Keitel
parent ecb794adf5
commit cde1a1f673
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/video/fbdev/msm/mdss_fb.c
View file

@ -3791,7 +3791,7 @@ static int mdss_fb_display_commit(struct fb_info *info,
static int mdss_fb_atomic_commit_ioctl(struct fb_info *info,
unsigned long *argp)
{
int ret, i = 0, rc;
int ret, i = 0, j = 0, rc;
struct mdp_layer_commit commit;
u32 buffer_size, layer_count;
struct mdp_input_layer *layer, *layer_list = NULL;
@ -3879,9 +3879,12 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info,
pr_err("atomic commit failed ret:%d\n", ret);
if (layer_count) {
rc = copy_to_user(input_layer_list, layer_list, buffer_size);
if (rc)
pr_err("layer error code copy to user failed\n");
for (j = 0; j < layer_count; j++) {
rc = copy_to_user(&input_layer_list[i].error_code,
&layer_list[i].error_code, sizeof(int));
if (rc)
pr_err("layer error code copy to user failed\n");
}
commit.commit_v1.input_layers = input_layer_list;
commit.commit_v1.output_layer = output_layer_user;