Merge "msm: mdss: Fix to validate data copied from user space" (ab26d098) · Commits · e / devices / android_kernel_sony_msm8998

drivers/video/fbdev/msm/mdss_mdp_overlay.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -4429,16 +4429,20 @@ static int __mdss_overlay_src_split_sort(struct msm_fb_data_type *mfd,
		__overlay_swap_func);

		for (i = 0; i < num_ovs; i++) {
		if (ovs[i].z_order >= MDSS_MDP_MAX_STAGE) {
		pr_err("invalid stage:%u\n", ovs[i].z_order);
		return -EINVAL;
		}
		if (ovs[i].dst_rect.x < left_lm_w) {
		if (left_lm_zo_cnt[ovs[i].z_order] == 2) {
		pr_err("more than 2 ov @ stage%d on left lm\n",
		pr_err("more than 2 ov @ stage%u on left lm\n",
		ovs[i].z_order);
		return -EINVAL;
		}
		left_lm_zo_cnt[ovs[i].z_order]++;
		} else {
		if (right_lm_zo_cnt[ovs[i].z_order] == 2) {
		pr_err("more than 2 ov @ stage%d on right lm\n",
		pr_err("more than 2 ov @ stage%u on right lm\n",
		ovs[i].z_order);
		return -EINVAL;
		}