Merge "msm: mdss: Avoid direct dereference user input in pp cache config" (52f19eb0) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_mdp_pp_cache_config.c

+25 −9

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
		* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -185,8 +185,12 @@ static int pp_hist_lut_cache_params_pipe_v1_7(struct mdp_hist_lut_data *config,
		return -EINVAL;
		}

		memcpy(&hist_lut_usr_config, config->cfg_payload,
		sizeof(struct mdp_hist_lut_data_v1_7));
		if (copy_from_user(&hist_lut_usr_config,
		(void __user *) config->cfg_payload,
		sizeof(hist_lut_usr_config))) {
		pr_err("failed to copy hist lut config\n");
		return -EFAULT;
		}

		hist_lut_cache_data = pipe->pp_res.hist_lut_cfg_payload;
		if (!hist_lut_cache_data) {
		@@ -597,8 +601,12 @@ static int pp_pcc_cache_params_pipe_v1_7(struct mdp_pcc_cfg_data *config,
		return -EINVAL;
		}

		memcpy(&v17_usr_config, config->cfg_payload,
		sizeof(v17_usr_config));
		if (copy_from_user(&v17_usr_config,
		(void __user *) config->cfg_payload,
		sizeof(v17_usr_config))) {
		pr_err("failed to copy pcc config\n");
		return -EFAULT;
		}

		if (!(config->ops & MDP_PP_OPS_WRITE)) {
		pr_debug("write ops not set value of flag is %d\n",
		@@ -852,8 +860,12 @@ static int pp_igc_lut_cache_params_pipe_v1_7(struct mdp_igc_lut_data *config,
		goto igc_config_exit;
		}

		memcpy(&v17_usr_config, config->cfg_payload,
		sizeof(v17_usr_config));
		if (copy_from_user(&v17_usr_config,
		(void __user *) config->cfg_payload,
		sizeof(v17_usr_config))) {
		pr_err("failed to copy igc config\n");
		return -EFAULT;
		}

		if (!(config->ops & MDP_PP_OPS_WRITE)) {
		pr_debug("op for gamut %d\n", config->ops);
		@@ -1248,8 +1260,12 @@ static int pp_pa_cache_params_pipe_v1_7(struct mdp_pa_v2_cfg_data *config,
		return -EINVAL;
		}

		memcpy(&pa_usr_config, config->cfg_payload,
		sizeof(struct mdp_pa_data_v1_7));
		if (copy_from_user(&pa_usr_config,
		(void __user *) config->cfg_payload,
		sizeof(pa_usr_config))) {
		pr_err("failed to copy pa usr config\n");
		return -EFAULT;
		}

		pa_cache_data = pipe->pp_res.pa_cfg_payload;
		if (!pa_cache_data) {