Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38069d6f authored by Benet Clark's avatar Benet Clark
Browse files

msm: mdss: Clear allocated atomic commit kernel memory during copy 



Use kzalloc instead of kmalloc to avoid junk data in the allocated
memory for the layer list and scale data.

Change-Id: I4af206d9894027e940d85b733ce4107dd9c14008
Signed-off-by: default avatarBenet Clark <benetc@codeaurora.org>
parent b2328868

drivers/video/msm/mdss/mdss_fb.c

+5 −2
Original line number Diff line number Diff line
@@ -4058,7 +4058,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 
		goto err;

	} else if (layer_count) {

		buffer_size = sizeof(struct mdp_input_layer) * layer_count;

		layer_list = kmalloc(buffer_size, GFP_KERNEL);

		layer_list = kzalloc(buffer_size, GFP_KERNEL);

		if (!layer_list) {

			pr_err("unable to allocate memory for layers\n");

			ret = -ENOMEM;
@@ -4075,6 +4075,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 


		for (i = 0; i < layer_count; i++) {

			layer = &layer_list[i];

			scale = NULL;



			if (!(layer->flags & MDP_LAYER_PP)) {

				layer->pp_info = NULL;
@@ -4092,7 +4093,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 
				continue;

			}



			scale = kmalloc(sizeof(struct mdp_scale_data),

			scale = kzalloc(sizeof(struct mdp_scale_data),

				GFP_KERNEL);

			if (!scale) {

				pr_err("unable to allocate memory for overlays\n");
@@ -4106,6 +4107,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 
				pr_err("layer list copy from user failed, scale = %p\n",

						layer->scale);

				kfree(scale);

				scale = NULL;

				ret = -EFAULT;

				goto err;

			}
@@ -4136,6 +4138,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 
err:

	for (i--; i >= 0; i--) {

		kfree(layer_list[i].scale);

		layer_list[i].scale = NULL;

		mdss_mdp_free_layer_pp_info(&layer_list[i]);

	}

	kfree(layer_list);