Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb308a57 authored by Rahul Sharma's avatar Rahul Sharma Committed by Gerrit - the friendly Code Review server
Browse files

disp: msm: sde: add check before buffer copy 



This change adds a check for the length of the buffer
 before copying it to avoid a buffer overflow.

Change-Id: Ie6a08613d32f0975624e7035ab0f6cfdab42013b
Signed-off-by: default avatarRahul Sharma <rahsha@codeaurora.org>
parent 8f930152

drivers/gpu/drm/msm/sde/sde_connector.c

+1 −0
Original line number Diff line number Diff line
@@ -1522,6 +1522,7 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file, 
		return 0;

	}



	blen = min_t(size_t, MAX_CMD_PAYLOAD_SIZE, count);

	if (copy_to_user(buf, buffer, blen)) {

		SDE_ERROR("copy to user buffer failed\n");

		return -EFAULT;

drivers/gpu/drm/msm/sde_rsc.c

+2 −0
Original line number Diff line number Diff line
@@ -1218,6 +1218,7 @@ static ssize_t _sde_debugfs_mode_ctrl_read(struct file *file, char __user *buf, 
	if (blen <= 0)

		return 0;



	blen = min_t(size_t, MAX_BUFFER_SIZE, count);

	if (copy_to_user(buf, buffer, blen))

		return -EFAULT;
@@ -1311,6 +1312,7 @@ static ssize_t _sde_debugfs_vsync_mode_read(struct file *file, char __user *buf, 
	if (blen <= 0)

		return 0;



	blen = min_t(size_t, MAX_BUFFER_SIZE, count);

	if (copy_to_user(buf, buffer, blen))

		return -EFAULT;