samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: sde: fix null access for wb modes

Browse Source 
Writeback modes are passed from DRM driver client and it may provide
invalid configuration. Add null checks for sde_wb_config provided by
client to avoid null access in subsequent calls.

Change-Id: I0924f8907d98e2ecb891cfc0c09191823d9033e8
Signed-off-by: Lakshmi Narayana Kalavala <lkalaval@codeaurora.org>
This commit is contained in:
Lakshmi Narayana Kalavala
2019-06-13 11:41:01 -07:00
parent 9d87e36a77
commit 6da86ccee2
1 changed files with 48 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
msm/sde/sde_wb.c
View File

@@ -170,54 +170,58 @@ int sde_wb_connector_set_modes(struct sde_wb_device *wb_dev,
if (connected) { if (connected) {
SDE_DEBUG("connect\n"); SDE_DEBUG("connect\n");
if (count_modes && modes) { if (!count_modes || !modes) {
modeinfo = kcalloc(count_modes, SDE_ERROR("invalid count_modes :%u and modes :%d\n",
sizeof(struct drm_mode_modeinfo), count_modes, !modes);
GFP_KERNEL); return -EINVAL;
if (!modeinfo) { }
SDE_ERROR("invalid params\n");
ret = -ENOMEM;
goto error;
}
if (copy_from_user(modeinfo, modes, modeinfo = kcalloc(count_modes,
count_modes * sizeof(struct drm_mode_modeinfo),
sizeof(struct drm_mode_modeinfo))) { GFP_KERNEL);
SDE_ERROR("failed to copy modes\n"); if (!modeinfo) {
SDE_ERROR("invalid params\n");
ret = -ENOMEM;
goto error;
}
if (copy_from_user(modeinfo, modes,
count_modes *
sizeof(struct drm_mode_modeinfo))) {
SDE_ERROR("failed to copy modes\n");
kfree(modeinfo);
ret = -EFAULT;
goto error;
}
for (i = 0; i < count_modes; i++) {
struct drm_display_mode dispmode;
memset(&dispmode, 0, sizeof(dispmode));
ret = drm_mode_convert_umode(wb_dev->drm_dev,
&dispmode, &modeinfo[i]);
if (ret) {
SDE_ERROR(
"failed to convert mode %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x status:%d rc:%d\n",
i,
modeinfo[i].name,
modeinfo[i].vrefresh,
modeinfo[i].clock,
modeinfo[i].hdisplay,
modeinfo[i].hsync_start,
modeinfo[i].hsync_end,
modeinfo[i].htotal,
modeinfo[i].vdisplay,
modeinfo[i].vsync_start,
modeinfo[i].vsync_end,
modeinfo[i].vtotal,
modeinfo[i].type,
modeinfo[i].flags,
dispmode.status,
ret);
kfree(modeinfo); kfree(modeinfo);
ret = -EFAULT;
goto error; goto error;
} }
for (i = 0; i < count_modes; i++) {
struct drm_display_mode dispmode;
memset(&dispmode, 0, sizeof(dispmode));
ret = drm_mode_convert_umode(wb_dev->drm_dev,
&dispmode, &modeinfo[i]);
if (ret) {
SDE_ERROR(
"failed to convert mode %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x status:%d rc:%d\n",
i,
modeinfo[i].name,
modeinfo[i].vrefresh,
modeinfo[i].clock,
modeinfo[i].hdisplay,
modeinfo[i].hsync_start,
modeinfo[i].hsync_end,
modeinfo[i].htotal,
modeinfo[i].vdisplay,
modeinfo[i].vsync_start,
modeinfo[i].vsync_end,
modeinfo[i].vtotal,
modeinfo[i].type,
modeinfo[i].flags,
dispmode.status,
ret);
kfree(modeinfo);
goto error;
}
}
} }
if (wb_dev->modes) { if (wb_dev->modes) {