Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edf4f605 authored by Narender Ankam's avatar Narender Ankam
Browse files

msm: mdss: dsi: fix slab-out-of-bounds issue 



While handling dsi_gen_read_status, status buffer
was xlogging without checking for its max size.
Add proper conditional check to xlog status buffer.

Change-Id: Ia5a1fe18de123d2911c31ae79492b96f67e1273d
Signed-off-by: default avatarNarender Ankam <nankam@codeaurora.org>
parent baec7b06

drivers/video/fbdev/msm/mdss_dsi_panel.c

+5 −9
Original line number Diff line number Diff line
@@ -1769,17 +1769,13 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) 
	for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++)

		len += lenp[i];



	for (i = 0; i < len; i++) {

		pr_debug("[%i] return:0x%x status:0x%x\n",

			i, (unsigned int)ctrl->return_buf[i],

			(unsigned int)ctrl->status_value[j + i]);

		MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],

			ctrl->status_value[j + i]);

		j += len;

	}



	for (j = 0; j < ctrl->groups; ++j) {

		for (i = 0; i < len; ++i) {

			pr_debug("[%i] return:0x%x status:0x%x\n",

				i, ctrl->return_buf[i],

				(unsigned int)ctrl->status_value[group + i]);

			MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i],

					ctrl->status_value[group + i]);

			if (ctrl->return_buf[i] !=

				ctrl->status_value[group + i])

				break;