evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: mdss: Avoid direct dereference user input in pp cache config"

Browse source
This commit is contained in:
Linux Build Service Account 2017-07-14 17:59:53 -07:00 • committed by Gerrit - the friendly Code Review server
commit d70bfa127b
1 changed files with 25 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
drivers/video/fbdev/msm/mdss_mdp_pp_cache_config.c
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -194,8 +194,12 @@ static int pp_hist_lut_cache_params_pipe_v1_7(struct mdp_hist_lut_data *config,
return -EINVAL; return -EINVAL;
} }
memcpy(&hist_lut_usr_config, config->cfg_payload, if (copy_from_user(&hist_lut_usr_config,
sizeof(struct mdp_hist_lut_data_v1_7)); (void __user *) config->cfg_payload,
sizeof(hist_lut_usr_config))) {
pr_err("failed to copy hist lut config\n");
return -EFAULT;
}
hist_lut_cache_data = pipe->pp_res.hist_lut_cfg_payload; hist_lut_cache_data = pipe->pp_res.hist_lut_cfg_payload;
if (!hist_lut_cache_data) { if (!hist_lut_cache_data) {
@ -606,8 +610,12 @@ static int pp_pcc_cache_params_pipe_v1_7(struct mdp_pcc_cfg_data *config,
return -EINVAL; return -EINVAL;
} }
memcpy(&v17_usr_config, config->cfg_payload, if (copy_from_user(&v17_usr_config,
sizeof(v17_usr_config)); (void __user *) config->cfg_payload,
sizeof(v17_usr_config))) {
pr_err("failed to copy pcc config\n");
return -EFAULT;
}
if (!(config->ops & MDP_PP_OPS_WRITE)) { if (!(config->ops & MDP_PP_OPS_WRITE)) {
pr_debug("write ops not set value of flag is %d\n", pr_debug("write ops not set value of flag is %d\n",
@ -861,8 +869,12 @@ static int pp_igc_lut_cache_params_pipe_v1_7(struct mdp_igc_lut_data *config,
goto igc_config_exit; goto igc_config_exit;
} }
memcpy(&v17_usr_config, config->cfg_payload, if (copy_from_user(&v17_usr_config,
sizeof(v17_usr_config)); (void __user *) config->cfg_payload,
sizeof(v17_usr_config))) {
pr_err("failed to copy igc usr config\n");
return -EFAULT;
}
if (!(config->ops & MDP_PP_OPS_WRITE)) { if (!(config->ops & MDP_PP_OPS_WRITE)) {
pr_debug("op for gamut %d\n", config->ops); pr_debug("op for gamut %d\n", config->ops);
@ -1272,8 +1284,12 @@ static int pp_pa_cache_params_pipe_v1_7(struct mdp_pa_v2_cfg_data *config,
return -EINVAL; return -EINVAL;
} }
memcpy(&pa_usr_config, config->cfg_payload, if (copy_from_user(&pa_usr_config,
sizeof(struct mdp_pa_data_v1_7)); (void __user *) config->cfg_payload,
sizeof(pa_usr_config))) {
pr_err("failed to copy pa usr config\n");
return -EFAULT;
}
pa_cache_data = pipe->pp_res.pa_cfg_payload; pa_cache_data = pipe->pp_res.pa_cfg_payload;
if (!pa_cache_data) { if (!pa_cache_data) {