diff options
| author | Abhijit Kulkarni <kabhijit@codeaurora.org> | 2016-06-09 09:03:43 -0700 |
|---|---|---|
| committer | Kyle Yan <kyan@codeaurora.org> | 2016-06-13 19:06:16 -0700 |
| commit | 5f47a7839972fd1bd777d07c9c3aa3e58329c1a3 (patch) | |
| tree | f7561496a13e90084da328df519719d4ff9fa0fd /drivers | |
| parent | 0b8c4c2cee15064efe92f0f2bc409b11903e67f3 (diff) | |
msm: mdss: add validation for dest scaler count
User space can send the commit message with the dest scaler
structure populated and dest scaler count as 0, this would
cause null pointer access, this change adds validation for both
the fields.
Change-Id: I7a4ad3188f7a19427c096a596a502debdc2aac55
Signed-off-by: Abhijit Kulkarni <kabhijit@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_fb.c | 3 | ||||
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_layer.c | 16 |
2 files changed, 12 insertions, 7 deletions
diff --git a/drivers/video/fbdev/msm/mdss_fb.c b/drivers/video/fbdev/msm/mdss_fb.c index d6db871e5b1b..5888ad9e36be 100644 --- a/drivers/video/fbdev/msm/mdss_fb.c +++ b/drivers/video/fbdev/msm/mdss_fb.c @@ -4470,7 +4470,8 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, } ds_data_user = commit.commit_v1.dest_scaler; - if (ds_data_user) { + if ((ds_data_user) && + (commit.commit_v1.dest_scaler_cnt)) { ret = __mdss_fb_copy_destscaler_data(info, &commit); if (ret) { pr_err("copy dest scaler failed\n"); diff --git a/drivers/video/fbdev/msm/mdss_mdp_layer.c b/drivers/video/fbdev/msm/mdss_mdp_layer.c index 29d6caa8ff7b..59283c815897 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_layer.c +++ b/drivers/video/fbdev/msm/mdss_mdp_layer.c @@ -126,7 +126,7 @@ static int mdss_mdp_destination_scaler_pre_validate(struct mdss_mdp_ctl *ctl, * width and height accordingly. Otherwise, layer validate will fail * when we switch between scaling factor or disabling scaling. */ - if (test_bit(MDSS_CAPS_DEST_SCALER, mdata->mdss_caps_map) && ds_data) { + if (test_bit(MDSS_CAPS_DEST_SCALER, mdata->mdss_caps_map)) { if (ctl->mixer_left) { /* * Any scale update from usermode, we will update the @@ -2073,7 +2073,8 @@ static int __validate_layers(struct msm_fb_data_type *mfd, } if (test_bit(MDSS_CAPS_DEST_SCALER, mdata->mdss_caps_map) && - commit->dest_scaler) { + commit->dest_scaler && + commit->dest_scaler_cnt) { /* * Find out which DS block to use based on LM assignment */ @@ -2370,10 +2371,13 @@ int mdss_mdp_layer_atomic_validate(struct msm_fb_data_type *mfd, } } - if (mdss_mdp_destination_scaler_pre_validate(mdp5_data->ctl, - commit->dest_scaler)) { - pr_err("Destination scaler pre-validate failed\n"); - return -EINVAL; + if (commit->dest_scaler && commit->dest_scaler_cnt) { + rc = mdss_mdp_destination_scaler_pre_validate(mdp5_data->ctl, + commit->dest_scaler); + if (IS_ERR_VALUE(rc)) { + pr_err("Destination scaler pre-validate failed\n"); + return -EINVAL; + } } return __validate_layers(mfd, file, commit); |