diff options
| author | Narender Ankam <nankam@codeaurora.org> | 2018-08-30 21:45:59 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-10-05 01:46:54 -0700 |
| commit | f2d058d45f724e3b0cf02e1ea837066147fe3f2c (patch) | |
| tree | 706f7f21be1abfaff6c8c710451d510cd3be259e | |
| parent | d750db225fcac4b7b2928c910fb37b36aa42f6d6 (diff) | |
msm: mdss: dsi: fix slab-out-of-bounds issue
While handling dsi_gen_read_status, status buffer
was xlogging without checking for its max size.
Add proper conditional check to xlog status buffer.
Change-Id: Ia5a1fe18de123d2911c31ae79492b96f67e1273d
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_dsi_panel.c | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/drivers/video/fbdev/msm/mdss_dsi_panel.c b/drivers/video/fbdev/msm/mdss_dsi_panel.c index dbd58f93e907..e691f40e96bb 100644 --- a/drivers/video/fbdev/msm/mdss_dsi_panel.c +++ b/drivers/video/fbdev/msm/mdss_dsi_panel.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1803,17 +1803,13 @@ static bool mdss_dsi_cmp_panel_reg_v2(struct mdss_dsi_ctrl_pdata *ctrl) for (i = 0; i < ctrl->status_cmds.cmd_cnt; i++) len += lenp[i]; - for (i = 0; i < len; i++) { - pr_debug("[%i] return:0x%x status:0x%x\n", - i, (unsigned int)ctrl->return_buf[i], - (unsigned int)ctrl->status_value[j + i]); - MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i], - ctrl->status_value[j + i]); - j += len; - } - for (j = 0; j < ctrl->groups; ++j) { for (i = 0; i < len; ++i) { + pr_debug("[%i] return:0x%x status:0x%x\n", + i, ctrl->return_buf[i], + (unsigned int)ctrl->status_value[group + i]); + MDSS_XLOG(ctrl->ndx, ctrl->return_buf[i], + ctrl->status_value[group + i]); if (ctrl->return_buf[i] != ctrl->status_value[group + i]) break; |