Merge "fbdev/msm: sanitize debugfs inputs when reading mdp memory"

	return 0;

}

/**

 * mdss_debug_base_is_valid_range - verify if requested memory range is valid

 * @off: address offset in bytes

 * @cnt: memory size in bytes

 * Return: true if valid; false otherwise

 */

static bool mdss_debug_base_is_valid_range(u32 off, u32 cnt)

{

	struct mdss_data_type *mdata = mdss_mdp_get_mdata();

	struct mdss_debug_data *mdd = mdata->debug_inf.debug_data;

	struct range_dump_node *node;

	struct mdss_debug_base *base;

	pr_debug("check offset=0x%x cnt=0x%x\n", off, cnt);

	list_for_each_entry(base, &mdd->base_list, head) {

		list_for_each_entry(node, &base->dump_list, head) {

			pr_debug("%s: start=0x%x end=0x%x\n", node->range_name,

					node->offset.start, node->offset.end);

			if (node->offset.start <= off

					&& off <= node->offset.end

					&& off + cnt <= node->offset.end) {

				pr_debug("valid range requested\n");

				return true;

			}

		}

	}

	pr_err("invalid range requested\n");

	return false;

}

static ssize_t mdss_debug_base_offset_write(struct file *file,

		    const char __user *user_buf, size_t count, loff_t *ppos)

{

	buf[count] = 0;	/* end of string */

	if (sscanf(buf, "%5x %x", &off, &cnt) != 2)

		return -EFAULT;

	if (off % sizeof(u32))

		return -EINVAL;

	if (cnt > (dbg->max_offset - off))

		cnt = dbg->max_offset - off;

	if (!mdss_debug_base_is_valid_range(off, cnt))

		return -EINVAL;

	mutex_lock(&mdss_debug_lock);

	dbg->off = off;

	dbg->cnt = cnt;