evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: mdss: dsi: fix slab-out-of-bounds issue

Browse source 
While handling dsi_gen_read_status, status buffer
was xlogging without checking for its max size.
Add proper conditional check to xlog status buffer.

Change-Id: Ia5a1fe18de123d2911c31ae79492b96f67e1273d
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
This commit is contained in:
Narender Ankam 2018-08-30 21:45:59 +05:30 • committed by Gerrit - the friendly Code Review server
parent d750db225f
commit f2d058d45f
1 changed files with 6 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/video/fbdev/msm/mdss_dsi_panel.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. /* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -1803,17 +1803,13 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl)
for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++) for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++)
len += lenp[i]; len += lenp[i];
for (i = 0; i < len; i++) {
pr_debug("[%i] return:0x%x status:0x%x\n",
i, (unsigned int)ctrl->return_buf[i],
(unsigned int)ctrl->status_value[j + i]);
MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],
ctrl->status_value[j + i]);
j += len;
}
for (j = 0; j < ctrl->groups; ++j) { for (j = 0; j < ctrl->groups; ++j) {
for (i = 0; i < len; ++i) { for (i = 0; i < len; ++i) {
pr_debug("[%i] return:0x%x status:0x%x\n",
i, ctrl->return_buf[i],
(unsigned int)ctrl->status_value[group + i]);
MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],
ctrl->status_value[group + i]);
if (ctrl->return_buf[i] != if (ctrl->return_buf[i] !=
ctrl->status_value[group + i]) ctrl->status_value[group + i])
break; break;