samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "disp: msm: add check for buffer length before copy"

Browse Source
This commit is contained in:
qctecmdr
2019-11-01 12:09:12 -07:00
committed by Gerrit - the friendly Code Review server
parent 46ec8687c0 be08b4e451
commit d34c5f2215
3 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
msm/dsi/dsi_ctrl.c
View File

@@ -116,6 +116,9 @@ static ssize_t debugfs_state_info_read(struct file *file,
dsi_ctrl->clk_freq.pix_clk_rate, dsi_ctrl->clk_freq.pix_clk_rate,
dsi_ctrl->clk_freq.esc_clk_rate); dsi_ctrl->clk_freq.esc_clk_rate);
if (len > count)
len = count;
len = min_t(size_t, len, SZ_4K); len = min_t(size_t, len, SZ_4K);
if (copy_to_user(buff, buf, len)) { if (copy_to_user(buff, buf, len)) {
kfree(buf); kfree(buf);
@@ -171,6 +174,8 @@ static ssize_t debugfs_reg_dump_read(struct file *file,
return rc; return rc;
} }
if (len > count)
len = count;
len = min_t(size_t, len, SZ_4K); len = min_t(size_t, len, SZ_4K);
if (copy_to_user(buff, buf, len)) { if (copy_to_user(buff, buf, len)) {

5
msm/sde/sde_connector.c
View File

@@ -1809,7 +1809,10 @@ static ssize_t _sde_debugfs_conn_cmd_tx_sts_read(struct file *file,
return 0; return 0;
} }
blen = min_t(size_t, MAX_CMD_PAYLOAD_SIZE, count); if (blen > count)
blen = count;
blen = min_t(size_t, blen, MAX_CMD_PAYLOAD_SIZE);
if (copy_to_user(buf, buffer, blen)) { if (copy_to_user(buf, buffer, blen)) {
SDE_ERROR("copy to user buffer failed\n"); SDE_ERROR("copy to user buffer failed\n");
return -EFAULT; return -EFAULT;

10
msm/sde_rsc.c
View File

@@ -1184,7 +1184,10 @@ end:
if (blen <= 0) if (blen <= 0)
return 0; return 0;
blen = min_t(size_t, MAX_BUFFER_SIZE, count); if (blen > count)
blen = count;
blen = min_t(size_t, blen, MAX_BUFFER_SIZE);
if (copy_to_user(buf, buffer, blen)) if (copy_to_user(buf, buffer, blen))
return -EFAULT; return -EFAULT;
@@ -1278,7 +1281,10 @@ end:
if (blen <= 0) if (blen <= 0)
return 0; return 0;
blen = min_t(size_t, MAX_BUFFER_SIZE, count); if (blen > count)
blen = count;
blen = min_t(size_t, blen, MAX_BUFFER_SIZE);
if (copy_to_user(buf, buffer, blen)) if (copy_to_user(buf, buffer, blen))
return -EFAULT; return -EFAULT;