Merge "msm: mdss: Sanitize post processing inputs" (35daf1c2) · Commits · e / devices / android_kernel_sony_msm8994

drivers/video/msm/mdss/mdss_mdp_hwio.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -379,6 +379,8 @@ enum mdss_mdp_writeback_index {
		#define MDSS_MDP_REG_WB_CSC_BASE 0x260
		#define MDSS_MDP_REG_WB_DST_ADDR_SW_STATUS 0x2B0

		#define MDSS_MDP_MAX_AD_AL 65535
		#define MDSS_MDP_MAX_AD_STR 255

		#define MDSS_MDP_REG_AD_BYPASS 0x000
		#define MDSS_MDP_REG_AD_CTRL_0 0x004

drivers/video/msm/mdss/mdss_mdp_pp.c

+27 −2

Original line number	Diff line number	Diff line
		@@ -2857,6 +2857,7 @@ exit:
		return ret;
		}

		#define MDSS_MAX_HIST_BIN_SIZE 16777215
		int mdss_mdp_hist_start(struct mdp_histogram_start_req *req)
		{
		u32 done_shift_bit;
		@@ -2865,9 +2866,13 @@ int mdss_mdp_hist_start(struct mdp_histogram_start_req *req)
		int i, ret = 0;
		u32 disp_num, dspp_num = 0;
		u32 mixer_cnt, mixer_id[MDSS_MDP_INTF_MAX_LAYERMIXER];
		u32 frame_size;
		struct mdss_mdp_pipe *pipe;
		struct mdss_data_type *mdata = mdss_mdp_get_mdata();

		if (!mdss_is_ready())
		return -EPROBE_DEFER;

		if ((PP_BLOCK(req->block) < MDP_LOGICAL_BLOCK_DISP_0) \|\|
		(PP_BLOCK(req->block) >= MDP_BLOCK_MAX))
		return -EINVAL;
		@@ -2887,6 +2892,16 @@ int mdss_mdp_hist_start(struct mdp_histogram_start_req *req)
		ret = -EPERM;
		goto hist_exit;
		}

		frame_size = (mdata->ctl_off[mixer_id[0]].width *
		mdata->ctl_off[mixer_id[0]].height);
		if (!frame_size \|\|
		((MDSS_MAX_HIST_BIN_SIZE / frame_size) < req->frame_cnt)) {
		pr_err("%s, too many frames for given display size, %d",
		__func__, req->frame_cnt);
		ret = -EINVAL;
		goto hist_exit;
		}
		mdss_mdp_clk_ctrl(MDP_BLOCK_POWER_ON, false);

		if (PP_LOCAT(req->block) == MDSS_PP_SSPP_CFG) {
		@@ -3698,6 +3713,11 @@ int mdss_mdp_ad_input(struct msm_fb_data_type *mfd,
		ret = -EINVAL;
		goto error;
		}
		if (input->in.amb_light > MDSS_MDP_MAX_AD_AL) {
		pr_warn("invalid input ambient light");
		ret = -EINVAL;
		goto error;
		}
		ad->ad_data_mode = MDSS_AD_INPUT_AMBIENT;
		pr_debug("ambient = %d", input->in.amb_light);
		ad->ad_data = input->in.amb_light;
		@@ -3712,6 +3732,11 @@ int mdss_mdp_ad_input(struct msm_fb_data_type *mfd,
		ret = -EINVAL;
		goto error;
		}
		if (input->in.strength > MDSS_MDP_MAX_AD_STR) {
		pr_warn("invalid input strength");
		ret = -EINVAL;
		goto error;
		}
		ad->ad_data_mode = MDSS_AD_INPUT_STRENGTH;
		pr_debug("strength = %d", input->in.strength);
		ad->ad_data = input->in.strength;
		@@ -4593,8 +4618,8 @@ int mdss_mdp_calib_config_buffer(struct mdp_calib_config_buffer *cfg,
		return ret;
		}

		if (cfg->size == 0) {
		pr_err("Invalid buffer size\n");
		if (cfg->size == 0 \|\| cfg->size > PAGE_SIZE) {
		pr_err("Invalid buffer size %d\n", cfg->size);
		return ret;
		}