Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d0702af authored by Krishna Chaitanya Parimi's avatar Krishna Chaitanya Parimi Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: fb: Copy & send unsigned value for notify update 



Copy unsigned long from userspace and modify the data fields
before copying back unsigned long data to userspace. This
keeps the datatypes of all operands homogeneous without
data leaks from kernel to user land.

CRs-Fixed: 526286
Change-Id: Ie4673563170c3459019dd6a5f1f55376f6e560c7
Signed-off-by: default avatarKrishna Chaitanya Parimi <cparimi@codeaurora.org>
Signed-off-by: default avatarManoj Rao <manojraj@codeaurora.org>
parent 0ebc9c40

drivers/video/msm/mdss/mdss_fb.c

+6 −5
Original line number Diff line number Diff line
@@ -107,9 +107,10 @@ void mdss_fb_no_update_notify_timer_cb(unsigned long data) 
static int mdss_fb_notify_update(struct msm_fb_data_type *mfd,

							unsigned long *argp)

{

	int ret, notify, to_user;

	int ret;

	unsigned long notify = 0x0, to_user = 0x0;



	ret = copy_from_user(&notify, argp, sizeof(int));

	ret = copy_from_user(&notify, argp, sizeof(unsigned long));

	if (ret) {

		pr_err("%s:ioctl failed\n", __func__);

		return ret;
@@ -122,12 +123,12 @@ static int mdss_fb_notify_update(struct msm_fb_data_type *mfd, 
		INIT_COMPLETION(mfd->update.comp);

		ret = wait_for_completion_interruptible_timeout(

						&mfd->update.comp, 4 * HZ);

		to_user = mfd->update.value;

		to_user = (unsigned int)mfd->update.value;

	} else if (notify == NOTIFY_UPDATE_STOP) {

		INIT_COMPLETION(mfd->no_update.comp);

		ret = wait_for_completion_interruptible_timeout(

						&mfd->no_update.comp, 4 * HZ);

		to_user = mfd->no_update.value;

		to_user = (unsigned int)mfd->no_update.value;

	} else {

		if (mfd->panel_power_on) {

			INIT_COMPLETION(mfd->power_off_comp);
@@ -139,7 +140,7 @@ static int mdss_fb_notify_update(struct msm_fb_data_type *mfd, 
	if (ret == 0)

		ret = -ETIMEDOUT;

	else if (ret > 0)

		ret = copy_to_user(argp, &to_user, sizeof(int));

		ret = copy_to_user(argp, &to_user, sizeof(unsigned long));

	return ret;

}