Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22201203 authored by Veera Sundaram Sankaran's avatar Veera Sundaram Sankaran
Browse files

msm: mdss: add additional bound checks for deinterlace layers 



Add necessary buffer size checks for deinterlace layers during
validate. Invalid src rect configuration on mdp hardware was
leading to unmapped memory access. A valid bound check fixes the
input validataion and avoids such memory access.

Change-Id: Ic83ef5ea008e8d8043ab2bcf9278ec72e0269fa1
Signed-off-by: default avatarVeera Sundaram Sankaran <veeras@codeaurora.org>
parent 993649f1

drivers/video/msm/mdss/mdss_mdp_layer.c

+12 −7
Original line number Diff line number Diff line
@@ -167,7 +167,7 @@ static int __layer_param_check(struct msm_fb_data_type *mfd, 
	int content_secure;

	struct mdss_data_type *mdata = mfd_to_mdata(mfd);

	struct mdss_mdp_ctl *ctl = mfd_to_ctl(mfd);

	u32 src_w, src_h, dst_w, dst_h;

	u32 src_w, src_h, dst_w, dst_h, width, height;



	if (!ctl) {

		pr_err("ctl is null\n");
@@ -199,16 +199,21 @@ static int __layer_param_check(struct msm_fb_data_type *mfd, 
		return -EINVAL;

	}



	width = layer->buffer.width;

	height = layer->buffer.height;

	if (layer->flags & MDP_LAYER_DEINTERLACE) {

		width *= 2;

		height /= 2;

	}



	if (layer->buffer.width > MAX_IMG_WIDTH ||

	    layer->buffer.height > MAX_IMG_HEIGHT ||

	    layer->src_rect.w < min_src_size ||

	    layer->src_rect.h < min_src_size ||

	    CHECK_LAYER_BOUNDS(layer->src_rect.x, layer->src_rect.w,

			layer->buffer.width) ||

	    CHECK_LAYER_BOUNDS(layer->src_rect.y, layer->src_rect.h,

			layer->buffer.height)) {

		pr_err("invalid source image img wh=%dx%d rect=%d,%d,%d,%d\n",

		       layer->buffer.width, layer->buffer.height,

	    CHECK_LAYER_BOUNDS(layer->src_rect.x, layer->src_rect.w, width) ||

	    CHECK_LAYER_BOUNDS(layer->src_rect.y, layer->src_rect.h, height)) {

		pr_err("invalid source image img flag=%d wh=%dx%d rect=%d,%d,%d,%d\n",

		       layer->flags, width, height,

		       layer->src_rect.x, layer->src_rect.y,

		       layer->src_rect.w, layer->src_rect.h);

		return -EINVAL;