Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c2c42f4 authored by Sravan Kumar D.V.N's avatar Sravan Kumar D.V.N Committed by raghavendra ambadas
Browse files

msm: mdss: Avoid direct dereference user input in pp cache config 



Eliminate direct dereferencing of user input pointer in pp cache
config functions.

Change-Id: Ia07a0ecc3b4839635cbd9c2f635c1f713783683c
CRs-Fixed: 2057285
Signed-off-by: default avatarSravan Kumar D.V.N <sravank1@codeaurora.org>
parent 58cbb103

drivers/video/msm/mdss/mdss_mdp_pp_cache_config.c

+25 −9
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

 * Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -185,8 +185,12 @@ static int pp_hist_lut_cache_params_pipe_v1_7(struct mdp_hist_lut_data *config, 
		return -EINVAL;

	}



	memcpy(&hist_lut_usr_config, config->cfg_payload,

		sizeof(struct mdp_hist_lut_data_v1_7));

	if (copy_from_user(&hist_lut_usr_config,

				(void __user *) config->cfg_payload,

				sizeof(hist_lut_usr_config))) {

		pr_err("failed to copy hist lut config\n");

		return -EFAULT;

	}



	hist_lut_cache_data = pipe->pp_res.hist_lut_cfg_payload;

	if (!hist_lut_cache_data) {
@@ -597,8 +601,12 @@ static int pp_pcc_cache_params_pipe_v1_7(struct mdp_pcc_cfg_data *config, 
		return -EINVAL;

	}



	memcpy(&v17_usr_config, config->cfg_payload,

			sizeof(v17_usr_config));

	if (copy_from_user(&v17_usr_config,

				(void __user *) config->cfg_payload,

				sizeof(v17_usr_config))) {

		pr_err("failed to copy pcc config\n");

		return -EFAULT;

	}



	if (!(config->ops & MDP_PP_OPS_WRITE)) {

		pr_debug("write ops not set value of flag is %d\n",
@@ -852,8 +860,12 @@ static int pp_igc_lut_cache_params_pipe_v1_7(struct mdp_igc_lut_data *config, 
		goto igc_config_exit;

	}



	memcpy(&v17_usr_config, config->cfg_payload,

			sizeof(v17_usr_config));

	if (copy_from_user(&v17_usr_config,

				(void __user *) config->cfg_payload,

				sizeof(v17_usr_config))) {

		pr_err("failed to copy igc config\n");

		return -EFAULT;

	}



	if (!(config->ops & MDP_PP_OPS_WRITE)) {

		pr_debug("op for gamut %d\n", config->ops);
@@ -1248,8 +1260,12 @@ static int pp_pa_cache_params_pipe_v1_7(struct mdp_pa_v2_cfg_data *config, 
		return -EINVAL;

	}



	memcpy(&pa_usr_config, config->cfg_payload,

			sizeof(struct mdp_pa_data_v1_7));

	if (copy_from_user(&pa_usr_config,

				(void __user *) config->cfg_payload,

				sizeof(pa_usr_config))) {

		pr_err("failed to copy pa usr config\n");

		return -EFAULT;

	}



	pa_cache_data = pipe->pp_res.pa_cfg_payload;

	if (!pa_cache_data) {