evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: mdss: Clear compat structures before copying to user"

Browse source
This commit is contained in:
Linux Build Service Account 2016-12-19 00:44:44 -08:00 • committed by Gerrit - the friendly Code Review server
commit dfff00f2cb
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/video/fbdev/msm/mdss_compat_utils.c
View file

@ -846,6 +846,7 @@ static int __from_user_pcc_coeff_v17(
return -EFAULT; return -EFAULT;
} }
memset(&pcc_cfg_payload, 0, sizeof(pcc_cfg_payload));
pcc_cfg_payload.r.b = pcc_cfg_payload32.r.b; pcc_cfg_payload.r.b = pcc_cfg_payload32.r.b;
pcc_cfg_payload.r.g = pcc_cfg_payload32.r.g; pcc_cfg_payload.r.g = pcc_cfg_payload32.r.g;
pcc_cfg_payload.r.c = pcc_cfg_payload32.r.c; pcc_cfg_payload.r.c = pcc_cfg_payload32.r.c;
@ -1127,6 +1128,8 @@ static int __from_user_igc_lut_data_v17(
pr_err("failed to copy payload from user for igc\n"); pr_err("failed to copy payload from user for igc\n");
return -EFAULT; return -EFAULT;
} }
memset(&igc_cfg_payload, 0, sizeof(igc_cfg_payload));
igc_cfg_payload.c0_c1_data = compat_ptr(igc_cfg_payload_32.c0_c1_data); igc_cfg_payload.c0_c1_data = compat_ptr(igc_cfg_payload_32.c0_c1_data);
igc_cfg_payload.c2_data = compat_ptr(igc_cfg_payload_32.c2_data); igc_cfg_payload.c2_data = compat_ptr(igc_cfg_payload_32.c2_data);
igc_cfg_payload.len = igc_cfg_payload_32.len; igc_cfg_payload.len = igc_cfg_payload_32.len;
@ -1261,6 +1264,7 @@ static int __from_user_pgc_lut_data_v1_7(
pr_err("failed to copy from user the pgc32 payload\n"); pr_err("failed to copy from user the pgc32 payload\n");
return -EFAULT; return -EFAULT;
} }
memset(&pgc_cfg_payload, 0, sizeof(pgc_cfg_payload));
pgc_cfg_payload.c0_data = compat_ptr(pgc_cfg_payload_32.c0_data); pgc_cfg_payload.c0_data = compat_ptr(pgc_cfg_payload_32.c0_data);
pgc_cfg_payload.c1_data = compat_ptr(pgc_cfg_payload_32.c1_data); pgc_cfg_payload.c1_data = compat_ptr(pgc_cfg_payload_32.c1_data);
pgc_cfg_payload.c2_data = compat_ptr(pgc_cfg_payload_32.c2_data); pgc_cfg_payload.c2_data = compat_ptr(pgc_cfg_payload_32.c2_data);
@ -1470,6 +1474,7 @@ static int __from_user_hist_lut_data_v1_7(
return -EFAULT; return -EFAULT;
} }
memset(&hist_lut_cfg_payload, 0, sizeof(hist_lut_cfg_payload));
hist_lut_cfg_payload.len = hist_lut_cfg_payload32.len; hist_lut_cfg_payload.len = hist_lut_cfg_payload32.len;
hist_lut_cfg_payload.data = compat_ptr(hist_lut_cfg_payload32.data); hist_lut_cfg_payload.data = compat_ptr(hist_lut_cfg_payload32.data);
@ -2024,6 +2029,7 @@ static int __from_user_pa_data_v1_7(
return -EFAULT; return -EFAULT;
} }
memset(&pa_cfg_payload, 0, sizeof(pa_cfg_payload));
pa_cfg_payload.mode = pa_cfg_payload32.mode; pa_cfg_payload.mode = pa_cfg_payload32.mode;
pa_cfg_payload.global_hue_adj = pa_cfg_payload32.global_hue_adj; pa_cfg_payload.global_hue_adj = pa_cfg_payload32.global_hue_adj;
pa_cfg_payload.global_sat_adj = pa_cfg_payload32.global_sat_adj; pa_cfg_payload.global_sat_adj = pa_cfg_payload32.global_sat_adj;
@ -2280,6 +2286,8 @@ static int __from_user_gamut_cfg_data_v17(
pr_err("failed to copy the gamut payload from userspace\n"); pr_err("failed to copy the gamut payload from userspace\n");
return -EFAULT; return -EFAULT;
} }
memset(&gamut_cfg_payload, 0, sizeof(gamut_cfg_payload));
gamut_cfg_payload.mode = gamut_cfg_payload32.mode; gamut_cfg_payload.mode = gamut_cfg_payload32.mode;
for (i = 0; i < MDP_GAMUT_TABLE_NUM_V1_7; i++) { for (i = 0; i < MDP_GAMUT_TABLE_NUM_V1_7; i++) {
gamut_cfg_payload.tbl_size[i] = gamut_cfg_payload.tbl_size[i] =