Merge "drm/msm/sde: restrict directly accessing data in user pointers" (4e80278d) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/gpu/drm/msm/sde/sde_connector.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -889,7 +889,7 @@ int sde_connector_roi_v1_check_roi(struct drm_connector_state *conn_state)
		static int _sde_connector_set_roi_v1(
		struct sde_connector *c_conn,
		struct sde_connector_state *c_state,
		void *usr_ptr)
		void __user *usr_ptr)
		{
		struct sde_drm_roi_v1 roi_v1;
		int i;
		@@ -940,7 +940,7 @@ static int _sde_connector_set_roi_v1(
		static int _sde_connector_set_ext_hdr_info(
		struct sde_connector *c_conn,
		struct sde_connector_state *c_state,
		void *usr_ptr)
		void __user *usr_ptr)
		{
		int rc = 0;
		struct drm_connector *connector;
		@@ -1074,7 +1074,8 @@ static int sde_connector_atomic_set_property(struct drm_connector *connector,
		}
		break;
		case CONNECTOR_PROP_ROI_V1:
		rc = _sde_connector_set_roi_v1(c_conn, c_state, (void *)val);
		rc = _sde_connector_set_roi_v1(c_conn,
		c_state, (void __user *)val);
		if (rc)
		SDE_ERROR_CONN(c_conn, "invalid roi_v1, rc: %d\n", rc);
		break;
		@@ -1097,7 +1098,7 @@ static int sde_connector_atomic_set_property(struct drm_connector *connector,

		if (idx == CONNECTOR_PROP_HDR_METADATA) {
		rc = _sde_connector_set_ext_hdr_info(c_conn,
		c_state, (void *)val);
		c_state, (void __user *)val);
		if (rc)
		SDE_ERROR_CONN(c_conn, "cannot set hdr info %d\n", rc);
		}

drivers/gpu/drm/msm/sde/sde_plane.c

+9 −8

Original line number	Diff line number	Diff line
		@@ -4460,7 +4460,8 @@ static void _sde_plane_install_properties(struct drm_plane *plane,
		PLANE_PROP_FB_TRANSLATION_MODE);
		}

		static inline void _sde_plane_set_csc_v1(struct sde_plane psde, void usr_ptr)
		static inline void _sde_plane_set_csc_v1(struct sde_plane *psde,
		void __user *usr_ptr)
		{
		struct sde_drm_csc_v1 csc_v1;
		int i;
		@@ -4496,7 +4497,7 @@ static inline void _sde_plane_set_csc_v1(struct sde_plane psde, void usr_ptr)
		}

		static inline void _sde_plane_set_scaler_v1(struct sde_plane *psde,
		struct sde_plane_state pstate, void usr)
		struct sde_plane_state pstate, void __user usr)
		{
		struct sde_drm_scaler_v1 scale_v1;
		struct sde_hw_pixel_ext *pe;
		@@ -4555,7 +4556,7 @@ static inline void _sde_plane_set_scaler_v1(struct sde_plane *psde,
		}

		static inline void _sde_plane_set_scaler_v2(struct sde_plane *psde,
		struct sde_plane_state pstate, void usr)
		struct sde_plane_state pstate, void __user usr)
		{
		struct sde_drm_scaler_v2 scale_v2;
		struct sde_hw_pixel_ext *pe;
		@@ -4617,7 +4618,7 @@ static inline void _sde_plane_set_scaler_v2(struct sde_plane *psde,
		}

		static void _sde_plane_set_excl_rect_v1(struct sde_plane *psde,
		struct sde_plane_state pstate, void usr_ptr)
		struct sde_plane_state pstate, void __user usr_ptr)
		{
		struct drm_clip_rect excl_rect_v1;

		@@ -4675,19 +4676,19 @@ static int sde_plane_atomic_set_property(struct drm_plane *plane,
		break;
		case PLANE_PROP_CSC_V1:
		case PLANE_PROP_CSC_DMA_V1:
		_sde_plane_set_csc_v1(psde, (void *)val);
		_sde_plane_set_csc_v1(psde, (void __user *)val);
		break;
		case PLANE_PROP_SCALER_V1:
		_sde_plane_set_scaler_v1(psde, pstate,
		(void *)val);
		(void __user *)val);
		break;
		case PLANE_PROP_SCALER_V2:
		_sde_plane_set_scaler_v2(psde, pstate,
		(void *)val);
		(void __user *)val);
		break;
		case PLANE_PROP_EXCL_RECT_V1:
		_sde_plane_set_excl_rect_v1(psde, pstate,
		(void *)val);
		(void __user *)val);
		break;
		default:
		/* nothing to do */