Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f47a783 authored by Abhijit Kulkarni's avatar Abhijit Kulkarni Committed by Kyle Yan
Browse files

msm: mdss: add validation for dest scaler count 



User space can send the commit message with the dest scaler
structure populated and dest scaler count as 0, this would
cause null pointer access, this change adds validation for both
the fields.

Change-Id: I7a4ad3188f7a19427c096a596a502debdc2aac55
Signed-off-by: default avatarAbhijit Kulkarni <kabhijit@codeaurora.org>
parent 0b8c4c2c

drivers/video/fbdev/msm/mdss_fb.c

+2 −1
Original line number Diff line number Diff line
@@ -4470,7 +4470,8 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 
	}



	ds_data_user = commit.commit_v1.dest_scaler;

	if (ds_data_user) {

	if ((ds_data_user) &&

		(commit.commit_v1.dest_scaler_cnt)) {

		ret = __mdss_fb_copy_destscaler_data(info, &commit);

		if (ret) {

			pr_err("copy dest scaler failed\n");

drivers/video/fbdev/msm/mdss_mdp_layer.c

+10 −6
Original line number Diff line number Diff line
@@ -126,7 +126,7 @@ static int mdss_mdp_destination_scaler_pre_validate(struct mdss_mdp_ctl *ctl, 
	 * width and height accordingly. Otherwise, layer validate will fail

	 * when we switch between scaling factor or disabling scaling.

	 */

	if (test_bit(MDSS_CAPS_DEST_SCALER, mdata->mdss_caps_map) && ds_data) {

	if (test_bit(MDSS_CAPS_DEST_SCALER, mdata->mdss_caps_map)) {

		if (ctl->mixer_left) {

			/*

			 * Any scale update from usermode, we will update the
@@ -2073,7 +2073,8 @@ static int __validate_layers(struct msm_fb_data_type *mfd, 
	}



	if (test_bit(MDSS_CAPS_DEST_SCALER, mdata->mdss_caps_map) &&

			commit->dest_scaler) {

			commit->dest_scaler &&

			commit->dest_scaler_cnt) {

		/*

		 * Find out which DS block to use based on LM assignment

		 */
@@ -2370,11 +2371,14 @@ int mdss_mdp_layer_atomic_validate(struct msm_fb_data_type *mfd, 
		}

	}



	if (mdss_mdp_destination_scaler_pre_validate(mdp5_data->ctl,

				commit->dest_scaler)) {

	if (commit->dest_scaler && commit->dest_scaler_cnt) {

		rc = mdss_mdp_destination_scaler_pre_validate(mdp5_data->ctl,

				commit->dest_scaler);

		if (IS_ERR_VALUE(rc)) {

			pr_err("Destination scaler pre-validate failed\n");

			return -EINVAL;

		}

	}



	return __validate_layers(mfd, file, commit);

}