Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7808df1 authored by Seung-Woo Kim's avatar Seung-Woo Kim Committed by Inki Dae
Browse files

drm/exynos: added validation of edid for vidi connection 



If edid of vidi from user is invalid, size calculated from a number
of cea extensions can be wrong. So, validation should be checked.

Changelog v2:
- just code cleanup
  . declare raw_edid only if vidi->connection is enabled.

Signed-off-by: default avatarSeung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: default avatarKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: default avatarInki Dae <inki.dae@samsung.com>
parent 9c08e4ba

drivers/gpu/drm/exynos/exynos_drm_vidi.c

+3 −4
Original line number Original line Diff line number Diff line
@@ -521,7 +521,6 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data, 
	struct exynos_drm_manager *manager;

	struct exynos_drm_manager *manager;

	struct exynos_drm_display_ops *display_ops;

	struct exynos_drm_display_ops *display_ops;

	struct drm_exynos_vidi_connection *vidi = data;

	struct drm_exynos_vidi_connection *vidi = data;

	struct edid *raw_edid;

	int edid_len;

	int edid_len;





	DRM_DEBUG_KMS("%s\n", __FILE__);

	DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -558,11 +557,11 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data, 
	}

	}





	if (vidi->connection) {

	if (vidi->connection) {

		if (!vidi->edid) {

		struct edid *raw_edid  = (struct edid *)(uint32_t)vidi->edid;

			DRM_DEBUG_KMS("edid data is null.\n");

		if (!drm_edid_is_valid(raw_edid)) {

			DRM_DEBUG_KMS("edid data is invalid.\n");

			return -EINVAL;

			return -EINVAL;

		}

		}

		raw_edid = (struct edid *)(uint32_t)vidi->edid;

		edid_len = (1 + raw_edid->extensions) * EDID_LENGTH;

		edid_len = (1 + raw_edid->extensions) * EDID_LENGTH;

		ctx->raw_edid = kzalloc(edid_len, GFP_KERNEL);

		ctx->raw_edid = kzalloc(edid_len, GFP_KERNEL);

		if (!ctx->raw_edid) {

		if (!ctx->raw_edid) {