Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 42507841 authored by Krishna Manikandan's avatar Krishna Manikandan
Browse files

msm: mdss: Memset commit structure in compat path 



Memset commit structure in compat path ioctl as some
of the pointer variables might go uninitialized, if not
explicitly initialized by the userspace. These uninitialized
variables contain garbage values which can further result
in kernel crash.

Change-Id: I09518a43438e27751f2b918d682f551550c4342e
Signed-off-by: default avatarJayant Shekhar <jshekhar@codeaurora.org>
Signed-off-by: default avatarKrishna Manikandan <mkrishn@codeaurora.org>
parent 90fd65ba

drivers/video/fbdev/msm/mdss_compat_utils.c

+2 −0
Original line number Diff line number Diff line
@@ -313,6 +313,8 @@ static int __compat_atomic_commit(struct fb_info *info, unsigned int cmd, 
		ret = -EFAULT;

		return ret;

	}



	memset(&commit, 0, sizeof(struct mdp_layer_commit));

	__copy_atomic_commit_struct(&commit, &commit32);



	if (commit32.commit_v1.output_layer) {

drivers/video/fbdev/msm/mdss_compat_utils.h

+1 −0
Original line number Diff line number Diff line
@@ -536,6 +536,7 @@ struct mdp_layer_commit_v1_32 { 
	int			retire_fence;

	compat_caddr_t		dest_scaler;

	uint32_t                dest_scaler_cnt;

	compat_caddr_t		frc_info;

	uint32_t		reserved[MDP_LAYER_COMMIT_V1_PAD];

};