Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78c119f8 authored by Jayant Shekhar's avatar Jayant Shekhar Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Fix argument in bus scale set quota 



Entry MDSS_HW_IOMMU in enum mdss_hw_index is used
as argument in function mdss_bus_scale_set_quota,
but originally the arguments comes from enum
mdss_bus_clients instead of enum mdss_hw_index so
that the array access overflow will happen since
the bus request array is allocated based on the
size of mdss_bus_clients.

Change-Id: I371f6c3ecb4f5723dd9700d5f31155e6dfa4263b
Signed-off-by: default avatarJayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: default avatarShivaraj Shetty <shivaraj@codeaurora.org>
parent 6b9938de

drivers/video/msm/mdss/mdss.h

+1 −1
Original line number Diff line number Diff line
@@ -110,7 +110,6 @@ enum mdss_hw_index { 
	MDSS_HW_DSI1,

	MDSS_HW_HDMI,

	MDSS_HW_EDP,

	MDSS_HW_IOMMU,

	MDSS_MAX_HW_BLK

};
@@ -118,6 +117,7 @@ enum mdss_bus_clients { 
	MDSS_MDP_RT,

	MDSS_DSI_RT,

	MDSS_MDP_NRT,

	MDSS_IOMMU_RT,

	MDSS_MAX_BUS_CLIENTS

};

drivers/video/msm/mdss/mdss_mdp.c

+2 −2
Original line number Diff line number Diff line
@@ -806,7 +806,7 @@ int mdss_iommu_ctrl(int enable) 
		 */

		if (!mdata->iommu_attached && !mdata->handoff_pending) {

			if (mdata->needs_iommu_bw_vote)

				mdss_bus_scale_set_quota(MDSS_HW_IOMMU,

				mdss_bus_scale_set_quota(MDSS_IOMMU_RT,

					SZ_1M, SZ_1M);

			rc = mdss_iommu_attach(mdata);

		}
@@ -817,7 +817,7 @@ int mdss_iommu_ctrl(int enable) 
			if (mdata->iommu_ref_cnt == 0) {

				rc = mdss_iommu_dettach(mdata);

				if (mdata->needs_iommu_bw_vote)

					mdss_bus_scale_set_quota(MDSS_HW_IOMMU,

					mdss_bus_scale_set_quota(MDSS_IOMMU_RT,

						0, 0);

			}

		} else {