disp: msm: sde: avoid sde debugfs register access based on HW ownership
Add VM ownership checks before accessing the HW through the debugfs path in sde crtc/encoder/connector modules to avoid illegal access. Change-Id: I4ff8f29353835d263beb2091bdeec40125addbf8 Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
此提交包含在:
@@ -1978,6 +1978,8 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
|
||||
{
|
||||
struct drm_connector *connector = file->private_data;
|
||||
struct sde_connector *c_conn = NULL;
|
||||
struct sde_vm_ops *vm_ops;
|
||||
struct sde_kms *sde_kms;
|
||||
char *input, *token, *input_copy, *input_dup = NULL;
|
||||
const char *delim = " ";
|
||||
char buffer[MAX_CMD_PAYLOAD_SIZE] = {0};
|
||||
@@ -1988,9 +1990,14 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
|
||||
SDE_ERROR("invalid argument(s), conn %d\n", connector != NULL);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
c_conn = to_sde_connector(connector);
|
||||
|
||||
sde_kms = _sde_connector_get_kms(&c_conn->base);
|
||||
if (!sde_kms) {
|
||||
SDE_ERROR("invalid kms\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!c_conn->ops.cmd_transfer) {
|
||||
SDE_ERROR("no cmd transfer support for connector name %s\n",
|
||||
c_conn->name);
|
||||
@@ -2001,6 +2008,14 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
|
||||
if (!input)
|
||||
return -ENOMEM;
|
||||
|
||||
vm_ops = sde_vm_get_ops(sde_kms);
|
||||
sde_vm_lock(sde_kms);
|
||||
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
|
||||
SDE_DEBUG("op not supported due to HW unavailablity\n");
|
||||
rc = -EOPNOTSUPP;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (copy_from_user(input, p, count)) {
|
||||
SDE_ERROR("copy from user failed\n");
|
||||
rc = -EFAULT;
|
||||
@@ -2050,6 +2065,7 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
|
||||
end1:
|
||||
kfree(input_dup);
|
||||
end:
|
||||
sde_vm_unlock(sde_kms);
|
||||
kfree(input);
|
||||
return rc;
|
||||
}
|
||||
|
新增問題並參考
封鎖使用者