Merge "msm: mdss: validate layer count before copying userdata" (682dbfa5) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/video/msm/mdss/mdss_compat_utils.c

+3 −3

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
		* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
		* Copyright (C) 1994 Martin Schaller
		*
		* 2001 - Documented with DocBook
		@@ -445,8 +445,8 @@ static int __compat_async_position_update(struct fb_info *info,

		update_pos.input_layer_cnt = update_pos32.input_layer_cnt;
		layer_cnt = update_pos32.input_layer_cnt;
		if (!layer_cnt) {
		pr_err("no async layer to update\n");
		if ((!layer_cnt) \|\| (layer_cnt > MAX_LAYER_COUNT)) {
		pr_err("invalid async layers :%d to update\n", layer_cnt);
		return -EINVAL;
		}

drivers/video/msm/mdss/mdss_fb.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -3911,8 +3911,8 @@ static int mdss_fb_async_position_update_ioctl(struct fb_info *info,
		input_layer_list = update_pos.input_layers;

		layer_cnt = update_pos.input_layer_cnt;
		if (!layer_cnt) {
		pr_err("no async layers to update\n");
		if ((!layer_cnt) \|\| (layer_cnt > MAX_LAYER_COUNT)) {
		pr_err("invalid async layers :%d to update\n", layer_cnt);
		return -EINVAL;
		}

drivers/video/msm/mdss/mdss_fb.h

+0 −1

Original line number	Diff line number	Diff line
		@@ -56,7 +56,6 @@

		#define MDP_PP_AD_BL_LINEAR 0x0
		#define MDP_PP_AD_BL_LINEAR_INV 0x1
		#define MAX_LAYER_COUNT 0xC

		/**
		* enum mdp_notify_event - Different frame events to indicate frame update state

drivers/video/msm/mdss/mdss_mdp.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -84,6 +84,8 @@

		#define XIN_HALT_TIMEOUT_US 0x4000

		#define MAX_LAYER_COUNT 0xC

		/* hw cursor can only be setup in highest mixer stage */
		#define HW_CURSOR_STAGE(mdata) \
		(((mdata)->max_target_zorder + MDSS_MDP_STAGE_0) - 1)

drivers/video/msm/mdss/mdss_rotator.c

+16 −2

Original line number	Diff line number	Diff line
		@@ -2146,6 +2146,7 @@ static int mdss_rotator_handle_request(struct mdss_rot_mgr *mgr,
		struct mdp_rotation_item *items = NULL;
		struct mdss_rot_entry_container *req = NULL;
		int size, ret;
		uint32_t req_count;

		if (mdss_get_sd_client_cnt()) {
		pr_err("rot request not permitted during secure display session\n");
		@@ -2159,12 +2160,18 @@ static int mdss_rotator_handle_request(struct mdss_rot_mgr *mgr,
		return ret;
		}

		req_count = user_req.count;
		if ((!req_count) \|\| (req_count > MAX_LAYER_COUNT)) {
		pr_err("invalid rotator req count :%d\n", req_count);
		return -EINVAL;
		}

		/*
		* here, we make a copy of the items so that we can copy
		* all the output fences to the client in one call. Otherwise,
		* we will have to call multiple copy_to_user
		*/
		size = sizeof(struct mdp_rotation_item) * user_req.count;
		size = sizeof(struct mdp_rotation_item) * req_count;
		items = devm_kzalloc(&mgr->pdev->dev, size, GFP_KERNEL);
		if (!items) {
		pr_err("fail to allocate rotation items\n");
		@@ -2303,6 +2310,7 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr,
		struct mdp_rotation_item *items = NULL;
		struct mdss_rot_entry_container *req = NULL;
		int size, ret;
		uint32_t req_count;

		if (mdss_get_sd_client_cnt()) {
		pr_err("rot request not permitted during secure display session\n");
		@@ -2316,7 +2324,13 @@ static int mdss_rotator_handle_request32(struct mdss_rot_mgr *mgr,
		return ret;
		}

		size = sizeof(struct mdp_rotation_item) * user_req32.count;
		req_count = user_req32.count;
		if ((!req_count) \|\| (req_count > MAX_LAYER_COUNT)) {
		pr_err("invalid rotator req count :%d\n", req_count);
		return -EINVAL;
		}

		size = sizeof(struct mdp_rotation_item) * req_count;
		items = devm_kzalloc(&mgr->pdev->dev, size, GFP_KERNEL);
		if (!items) {
		pr_err("fail to allocate rotation items\n");