samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: dp: validate edid before dereferencing

Browse Source 
Currently, when using custom edid from debugfs, the
extensions data inside the edid block is not validated
before dereferencing the extension block.

The fix adds a edid validation function to validate
any custom edids before accessing any members in the
edid block.

Change-Id: I8a2cc45477416a8f8c4cff882bd53d14012e29f4
Signed-off-by: Sudarsan Ramesh <sudarame@codeaurora.org>
This commit is contained in:
Sudarsan Ramesh
2020-11-03 17:52:12 -05:00
committed by Gerrit - the friendly Code Review server
parent 348e9b397c
commit c6b636fe0b
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
msm/dp/dp_panel.c
View File

@@ -9,6 +9,7 @@
#include "dp_debug.h"
#include <drm/drm_dsc.h>
#include "sde_dsc_helper.h"
#include <drm/drm_edid.h>
#define DP_KHZ_TO_HZ 1000
#define DP_PANEL_DEFAULT_BPP 24
@@ -1616,7 +1617,25 @@ static int dp_panel_set_default_link_params(struct dp_panel *dp_panel)
return 0;
}
static int dp_panel_set_edid(struct dp_panel *dp_panel, u8 *edid)
static bool dp_panel_validate_edid(struct edid *edid, size_t edid_size)
{
if (!edid || (edid_size < EDID_LENGTH))
return false;
if (EDID_LENGTH * (edid->extensions + 1) > edid_size) {
DP_ERR("edid size does not match allocated.\n");
return false;
}
if (!drm_edid_is_valid(edid)) {
DP_ERR("invalid edid.\n");
return false;
}
return true;
}
static int dp_panel_set_edid(struct dp_panel *dp_panel, u8 *edid,
size_t edid_size)
{
struct dp_panel_private *panel;
@@ -1627,7 +1646,7 @@ static int dp_panel_set_edid(struct dp_panel *dp_panel, u8 *edid)
panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
if (edid) {
if (edid && dp_panel_validate_edid((struct edid *)edid, edid_size)) {
dp_panel->edid_ctrl->edid = (struct edid *)edid;
panel->custom_edid = true;
} else {