Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 684e070a authored by Satya Rama Aditya Pinapala's avatar Satya Rama Aditya Pinapala
Browse files

disp: msm: dsi: fix out of bounds access errors 



This change fixes the invalid memory access. It allocates
enough memory so that out of bounds access is avoided.

Change-Id: I0749eac54cfa91891a4377b99fbd7f24dd3bd02a
Signed-off-by: default avatarSatya Rama Aditya Pinapala <psraditya30@codeaurora.org>
parent 74f32856

msm/dsi/dsi_display.c

+13 −8
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ 


#define MISR_BUFF_SIZE	256

#define ESD_MODE_STRING_MAX_LEN 256

#define ESD_TRIGGER_STRING_MAX_LEN 10



#define MAX_NAME_SIZE	64
@@ -1249,6 +1250,7 @@ static ssize_t debugfs_esd_trigger_check(struct file *file, 
	char *buf;

	int rc = 0;

	u32 esd_trigger;

	size_t len;



	if (!display)

		return -ENODEV;
@@ -1266,16 +1268,17 @@ static ssize_t debugfs_esd_trigger_check(struct file *file, 
		atomic_read(&display->panel->esd_recovery_pending))

		return user_len;



	buf = kzalloc(user_len, GFP_KERNEL);

	buf = kzalloc(ESD_TRIGGER_STRING_MAX_LEN, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;



	if (copy_from_user(buf, user_buf, user_len)) {

	len = min_t(size_t, user_len, ESD_TRIGGER_STRING_MAX_LEN - 1);

	if (copy_from_user(buf, user_buf, len)) {

		rc = -EINVAL;

		goto error;

	}



	buf[user_len] = '\0'; /* terminate the string */

	buf[len] = '\0'; /* terminate the string */



	if (kstrtouint(buf, 10, &esd_trigger)) {

		rc = -EINVAL;
@@ -1298,7 +1301,7 @@ static ssize_t debugfs_esd_trigger_check(struct file *file, 
		}

	}



	rc = user_len;

	rc = len;

error:

	kfree(buf);

	return rc;
@@ -1313,7 +1316,7 @@ static ssize_t debugfs_alter_esd_check_mode(struct file *file, 
	struct drm_panel_esd_config *esd_config;

	char *buf;

	int rc = 0;

	size_t len = min_t(size_t, user_len, ESD_MODE_STRING_MAX_LEN);

	size_t len;



	if (!display)

		return -ENODEV;
@@ -1321,10 +1324,11 @@ static ssize_t debugfs_alter_esd_check_mode(struct file *file, 
	if (*ppos)

		return 0;



	buf = kzalloc(len, GFP_KERNEL);

	buf = kzalloc(ESD_MODE_STRING_MAX_LEN, GFP_KERNEL);

	if (ZERO_OR_NULL_PTR(buf))

		return -ENOMEM;



	len = min_t(size_t, user_len, ESD_MODE_STRING_MAX_LEN - 1);

	if (copy_from_user(buf, user_buf, len)) {

		rc = -EINVAL;

		goto error;
@@ -1387,7 +1391,7 @@ static ssize_t debugfs_read_esd_check_mode(struct file *file, 
	struct drm_panel_esd_config *esd_config;

	char *buf;

	int rc = 0;

	size_t len = min_t(size_t, user_len, ESD_MODE_STRING_MAX_LEN);

	size_t len;



	if (!display)

		return -ENODEV;
@@ -1400,7 +1404,7 @@ static ssize_t debugfs_read_esd_check_mode(struct file *file, 
		return -EINVAL;

	}



	buf = kzalloc(len, GFP_KERNEL);

	buf = kzalloc(ESD_MODE_STRING_MAX_LEN, GFP_KERNEL);

	if (ZERO_OR_NULL_PTR(buf))

		return -ENOMEM;
@@ -1411,6 +1415,7 @@ static ssize_t debugfs_read_esd_check_mode(struct file *file, 
		goto error;

	}



	len = min_t(size_t, user_len, ESD_MODE_STRING_MAX_LEN - 1);

	if (!esd_config->esd_enabled) {

		rc = snprintf(buf, len, "ESD feature not enabled");

		goto output_mode;