Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 426cc924 authored by Carl Vanderlip's avatar Carl Vanderlip
Browse files

msm: mdss: Sanitize post processing inputs 



Sanitize the inputs to histogram, assertive display, and calibration buffer
so that invalid values cannot be used as feature configuration.

CRs-Fixed: 516710
Change-Id: Ifb585174b1baadbac628f53fe67f3c3b3ae61a54
Signed-off-by: default avatarCarl Vanderlip <carlv@codeaurora.org>
parent 0c2d6dd7

drivers/video/msm/mdss/mdss_mdp_hwio.h

+2 −0
Original line number Diff line number Diff line
@@ -380,6 +380,8 @@ enum mdss_mdp_writeback_index { 
#define MDSS_MDP_REG_WB_CSC_BASE			0x260

#define MDSS_MDP_REG_WB_DST_ADDR_SW_STATUS		0x2B0



#define MDSS_MDP_MAX_AD_AL	65535

#define MDSS_MDP_MAX_AD_STR	255



#define MDSS_MDP_REG_AD_BYPASS				0x000

#define MDSS_MDP_REG_AD_CTRL_0				0x004

drivers/video/msm/mdss/mdss_mdp_pp.c

+27 −2
Original line number Diff line number Diff line
@@ -2851,6 +2851,7 @@ exit: 
	return ret;

}



#define MDSS_MAX_HIST_BIN_SIZE 16777215

int mdss_mdp_hist_start(struct mdp_histogram_start_req *req)

{

	u32 done_shift_bit;
@@ -2859,9 +2860,13 @@ int mdss_mdp_hist_start(struct mdp_histogram_start_req *req) 
	int i, ret = 0;

	u32 disp_num, dspp_num = 0;

	u32 mixer_cnt, mixer_id[MDSS_MDP_INTF_MAX_LAYERMIXER];

	u32 frame_size;

	struct mdss_mdp_pipe *pipe;

	struct mdss_data_type *mdata = mdss_mdp_get_mdata();



	if (!mdss_is_ready())

		return -EPROBE_DEFER;



	if ((PP_BLOCK(req->block) < MDP_LOGICAL_BLOCK_DISP_0) ||

		(PP_BLOCK(req->block) >= MDP_BLOCK_MAX))

		return -EINVAL;
@@ -2881,6 +2886,16 @@ int mdss_mdp_hist_start(struct mdp_histogram_start_req *req) 
		ret = -EPERM;

		goto hist_exit;

	}



	frame_size = (mdata->ctl_off[mixer_id[0]].width *

					mdata->ctl_off[mixer_id[0]].height);

	if (!frame_size ||

		((MDSS_MAX_HIST_BIN_SIZE / frame_size) < req->frame_cnt)) {

		pr_err("%s, too many frames for given display size, %d",

						__func__, req->frame_cnt);

		ret = -EINVAL;

		goto hist_exit;

	}

	mdss_mdp_clk_ctrl(MDP_BLOCK_POWER_ON, false);



	if (PP_LOCAT(req->block) == MDSS_PP_SSPP_CFG) {
@@ -3692,6 +3707,11 @@ int mdss_mdp_ad_input(struct msm_fb_data_type *mfd, 
			ret = -EINVAL;

			goto error;

		}

		if (input->in.amb_light > MDSS_MDP_MAX_AD_AL) {

			pr_warn("invalid input ambient light");

			ret = -EINVAL;

			goto error;

		}

		ad->ad_data_mode = MDSS_AD_INPUT_AMBIENT;

		pr_debug("ambient = %d", input->in.amb_light);

		ad->ad_data = input->in.amb_light;
@@ -3706,6 +3726,11 @@ int mdss_mdp_ad_input(struct msm_fb_data_type *mfd, 
			ret = -EINVAL;

			goto error;

		}

		if (input->in.strength > MDSS_MDP_MAX_AD_STR) {

			pr_warn("invalid input strength");

			ret = -EINVAL;

			goto error;

		}

		ad->ad_data_mode = MDSS_AD_INPUT_STRENGTH;

		pr_debug("strength = %d", input->in.strength);

		ad->ad_data = input->in.strength;
@@ -4586,8 +4611,8 @@ int mdss_mdp_calib_config_buffer(struct mdp_calib_config_buffer *cfg, 
		return ret;

	}



	if (cfg->size == 0) {

		pr_err("Invalid buffer size\n");

	if (cfg->size == 0 || cfg->size > PAGE_SIZE) {

		pr_err("Invalid buffer size %d\n", cfg->size);

		return ret;

	}