Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6702b4a9 authored by Benet Clark's avatar Benet Clark
Browse files

msm: mdss: Copy only error code back to userspace after atomic commit 



Previously, the atomic commit ioctl copies the entire kernel layer list
to the userspace layer list structure. The only parameter modified
during atomic commit should be the error code, and therefore, the
only value needed by userspace after the atomic commit ioctl returns.
Copying the kernel layer list structure causes the userspace to have
stale kernel pointer references to scale and PP info structures.

Change-Id: Ia8e96af21f7d9594a47d1503f3afef50a767971f
Signed-off-by: default avatarBenet Clark <benetc@codeaurora.org>
parent 7d82d8c7

drivers/video/msm/mdss/mdss_fb.c

+7 −4
Original line number Original line Diff line number Diff line
@@ -3767,7 +3767,7 @@ static int mdss_fb_display_commit(struct fb_info *info, 
static int mdss_fb_atomic_commit_ioctl(struct fb_info *info,

static int mdss_fb_atomic_commit_ioctl(struct fb_info *info,

						unsigned long *argp)

						unsigned long *argp)

{

{

	int ret, i = 0, rc;

	int ret, i = 0, j = 0, rc;

	struct mdp_layer_commit  commit;

	struct mdp_layer_commit  commit;

	u32 buffer_size, layer_count;

	u32 buffer_size, layer_count;

	struct mdp_input_layer *layer, *layer_list = NULL;

	struct mdp_input_layer *layer, *layer_list = NULL;
@@ -3855,9 +3855,12 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, 
		pr_err("atomic commit failed ret:%d\n", ret);

		pr_err("atomic commit failed ret:%d\n", ret);





	if (layer_count) {

	if (layer_count) {

		rc = copy_to_user(input_layer_list, layer_list, buffer_size);

		for (j = 0; j < layer_count; j++) {

			rc = copy_to_user(&input_layer_list[i].error_code,

					&layer_list[i].error_code, sizeof(int));

			if (rc)

			if (rc)

				pr_err("layer error code copy to user failed\n");

				pr_err("layer error code copy to user failed\n");

		}





		commit.commit_v1.input_layers = input_layer_list;

		commit.commit_v1.input_layers = input_layer_list;

		commit.commit_v1.output_layer = output_layer_user;

		commit.commit_v1.output_layer = output_layer_user;