Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit acbe4e22 authored by Narendra Muppalla's avatar Narendra Muppalla Committed by Steve Cohen
Browse files

drm/msm/sde: Modify event notifier size to overcome out of bounds errors 



In DRM event notifier size of event is currently caculated
based on response event which is causing out of bounds access.
This change modifies this calculation based on drm
event instead of response event.

Change-Id: I67e0fd0da076313afcf4bfd347338400b612430d
Signed-off-by: default avatarNarendra Muppalla <NarendraM@codeaurora.org>
parent c72701ba

drivers/gpu/drm/msm/msm_drv.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -1463,7 +1463,7 @@ void msm_mode_object_event_notify(struct drm_mode_object *obj, 
		if (node->event.type != event->type ||

		if (node->event.type != event->type ||

			obj->id != node->info.object_id)

			obj->id != node->info.object_id)

			continue;

			continue;

		len = event->length + sizeof(struct drm_msm_event_resp);

		len = event->length + sizeof(struct msm_drm_event);

		if (node->base.file_priv->event_space < len) {

		if (node->base.file_priv->event_space < len) {

			DRM_ERROR("Insufficient space %d for event %x len %d\n",

			DRM_ERROR("Insufficient space %d for event %x len %d\n",

				node->base.file_priv->event_space, event->type,

				node->base.file_priv->event_space, event->type,
@@ -1477,7 +1477,8 @@ void msm_mode_object_event_notify(struct drm_mode_object *obj, 
		notify->base.event = &notify->event;

		notify->base.event = &notify->event;

		notify->base.pid = node->base.pid;

		notify->base.pid = node->base.pid;

		notify->event.type = node->event.type;

		notify->event.type = node->event.type;

		notify->event.length = len;

		notify->event.length = event->length +

					sizeof(struct drm_msm_event_resp);

		memcpy(&notify->info, &node->info, sizeof(notify->info));

		memcpy(&notify->info, &node->info, sizeof(notify->info));

		memcpy(notify->data, payload, event->length);

		memcpy(notify->data, payload, event->length);

		ret = drm_event_reserve_init_locked(dev, node->base.file_priv,

		ret = drm_event_reserve_init_locked(dev, node->base.file_priv,