Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4a35a49f authored by Rahul Sharma's avatar Rahul Sharma Committed by raghavendra ambadas
Browse files

disp: msm: sde: add check before buffer copy 



This change adds a check for the length of the buffer
before copying it to avoid a buffer overflow.

Change-Id: Ie6a08613d32f0975624e7035ab0f6cfdab42013b
Signed-off-by: default avatarRahul Sharma <rahsha@codeaurora.org>
parent 525f63ef

drivers/gpu/drm/msm/sde/sde_connector.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -1540,6 +1540,9 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file, 
		return 0;

		return 0;

	}

	}





	if (blen > count)

		blen = count;



	if (copy_to_user(buf, buffer, blen)) {

	if (copy_to_user(buf, buffer, blen)) {

		SDE_ERROR("copy to user buffer failed\n");

		SDE_ERROR("copy to user buffer failed\n");

		return -EFAULT;

		return -EFAULT;

drivers/gpu/drm/msm/sde_rsc.c

+7 −1
Original line number Original line Diff line number Diff line 
/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.

/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and
@@ -1044,6 +1044,9 @@ static ssize_t _sde_debugfs_mode_ctrl_read(struct file *file, char __user *buf, 
	if (blen <= 0)

	if (blen <= 0)

		return 0;

		return 0;





	if (blen > count)

		blen = count;



	if (copy_to_user(buf, buffer, blen))

	if (copy_to_user(buf, buffer, blen))

		return -EFAULT;

		return -EFAULT;
@@ -1136,6 +1139,9 @@ static ssize_t _sde_debugfs_vsync_mode_read(struct file *file, char __user *buf, 
	if (blen <= 0)

	if (blen <= 0)

		return 0;

		return 0;





	if (blen > count)

		blen = count;



	if (copy_to_user(buf, buffer, blen))

	if (copy_to_user(buf, buffer, blen))

		return -EFAULT;

		return -EFAULT;