Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 940c7552 authored by Jayant Shekhar's avatar Jayant Shekhar
Browse files

msm: mdss: Memset commit structure in compat path 



Memset commit structure in compat path ioctl as some
of the pointer variables might go uninitialized, if not
explicitly initialized by userspace. These uninitialized
variables contain garbage values which can further result
in kernel crash.

Change-Id: I09518a43438e27751f2b918d682f551550c4342e
Signed-off-by: default avatarJayant Shekhar <jshekhar@codeaurora.org>
parent a1b296b4

drivers/video/msm/mdss/mdss_compat_utils.c

+2 −0
Original line number Diff line number Diff line
@@ -314,6 +314,8 @@ static int __compat_atomic_commit(struct fb_info *info, unsigned int cmd, 
		ret = -EFAULT;

		return ret;

	}



	memset(&commit, 0, sizeof(struct mdp_layer_commit));

	__copy_atomic_commit_struct(&commit, &commit32);



	if (commit32.commit_v1.output_layer) {

drivers/video/msm/mdss/mdss_compat_utils.h

+1 −1
Original line number Diff line number Diff line
@@ -534,9 +534,9 @@ struct mdp_layer_commit_v1_32 { 
	uint32_t		input_layer_cnt;

	compat_caddr_t		output_layer;

	int			retire_fence;

	compat_caddr_t		frc_info;

	compat_caddr_t		dest_scaler;

	uint32_t                dest_scaler_cnt;

	compat_caddr_t		frc_info;

	uint32_t		reserved[MDP_LAYER_COMMIT_V1_PAD];

};