Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f2fadcf authored by Harsh Sahu's avatar Harsh Sahu Committed by Gerrit - the friendly Code Review server
Browse files

msm: mdss: Validating data values before passing on as operand 



mdss_mdp_dfps_update_params uses data as operand. Hence the values
are validated against their max values allowed to avoid any overflow
in this change.

CRs-fixed: 1116842
Change-Id: I630b9390a18446cd461154e31e08642a8ff06ed8
Signed-off-by: default avatarHarsh Sahu <hsahu@codeaurora.org>
parent e539a094

drivers/video/msm/mdss/mdss_mdp_overlay.c

+13 −0
Original line number Diff line number Diff line
@@ -49,6 +49,12 @@ 


#define BUF_POOL_SIZE 32



#define DFPS_DATA_MAX_HFP 8192

#define DFPS_DATA_MAX_HBP 8192

#define DFPS_DATA_MAX_HPW 8192

#define DFPS_DATA_MAX_FPS 0x7fffffff

#define DFPS_DATA_MAX_CLK_RATE 250000



static int mdss_mdp_overlay_free_fb_pipe(struct msm_fb_data_type *mfd);

static int mdss_mdp_overlay_fb_parse_dt(struct msm_fb_data_type *mfd);

static int mdss_mdp_overlay_off(struct msm_fb_data_type *mfd);
@@ -3901,6 +3907,13 @@ static ssize_t dynamic_fps_sysfs_wta_dfps(struct device *dev, 
		return count;

	}



	if (data.hfp > DFPS_DATA_MAX_HFP || data.hbp > DFPS_DATA_MAX_HBP ||

		data.hpw > DFPS_DATA_MAX_HPW || data.fps > DFPS_DATA_MAX_FPS ||

		data.clk_rate > DFPS_DATA_MAX_CLK_RATE){

		pr_err("Data values out of bound.\n");

		return -EINVAL;

	}



	rc = mdss_mdp_dfps_update_params(mfd, pdata, &data);

	if (rc) {

		pr_err("failed to set dfps params\n");