2017-11-07 17:32:46 -05:00
|
|
|
From ad8e758d30164290a71d9c59fbf7854029556a3e Mon Sep 17 00:00:00 2001
|
2017-10-29 01:48:53 -04:00
|
|
|
From: Harsh Sahu <hsahu@codeaurora.org>
|
|
|
|
Date: Fri, 21 Apr 2017 16:12:22 -0700
|
2017-11-07 17:32:46 -05:00
|
|
|
Subject: msm: mdss: fix memcpy source and dest memory buffer size mismatch
|
2017-10-29 01:48:53 -04:00
|
|
|
|
|
|
|
Currently memcpy is copying from a bigger memory size to a smaller
|
2017-11-07 17:32:46 -05:00
|
|
|
memory size. This change corrects this issue by performing the
|
|
|
|
memcopy restricted to the smaller of the src or dest memory buffer.
|
2017-10-29 01:48:53 -04:00
|
|
|
|
2017-11-07 17:32:46 -05:00
|
|
|
CRs-fixed: 2028228
|
2017-10-29 01:48:53 -04:00
|
|
|
Change-Id: Ibbe5665083799a4262d3cfbb06f94f3e35e03748
|
|
|
|
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
|
|
|
|
---
|
2017-11-07 17:32:46 -05:00
|
|
|
drivers/video/fbdev/msm/mdss_compat_utils.c | 5 ++++-
|
|
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
2017-10-29 01:48:53 -04:00
|
|
|
|
2017-11-07 17:32:46 -05:00
|
|
|
diff --git a/drivers/video/fbdev/msm/mdss_compat_utils.c b/drivers/video/fbdev/msm/mdss_compat_utils.c
|
|
|
|
index e9ba775..ba3dec2 100644
|
|
|
|
--- a/drivers/video/fbdev/msm/mdss_compat_utils.c
|
|
|
|
+++ b/drivers/video/fbdev/msm/mdss_compat_utils.c
|
|
|
|
@@ -119,6 +119,9 @@ static unsigned int __do_compat_ioctl_nr(unsigned int cmd32)
|
2017-10-29 01:48:53 -04:00
|
|
|
static void __copy_atomic_commit_struct(struct mdp_layer_commit *commit,
|
|
|
|
struct mdp_layer_commit32 *commit32)
|
|
|
|
{
|
|
|
|
+ unsigned int destSize = sizeof(commit->commit_v1.reserved);
|
|
|
|
+ unsigned int srcSize = sizeof(commit32->commit_v1.reserved);
|
|
|
|
+ unsigned int count = (destSize <= srcSize ? destSize : srcSize);
|
|
|
|
commit->version = commit32->version;
|
|
|
|
commit->commit_v1.flags = commit32->commit_v1.flags;
|
|
|
|
commit->commit_v1.input_layer_cnt =
|
2017-11-07 17:32:46 -05:00
|
|
|
@@ -127,7 +130,7 @@ static void __copy_atomic_commit_struct(struct mdp_layer_commit *commit,
|
2017-10-29 01:48:53 -04:00
|
|
|
commit->commit_v1.right_roi = commit32->commit_v1.right_roi;
|
2017-11-07 17:32:46 -05:00
|
|
|
commit->commit_v1.bl_level = commit32->commit_v1.bl_level;
|
2017-10-29 01:48:53 -04:00
|
|
|
memcpy(&commit->commit_v1.reserved, &commit32->commit_v1.reserved,
|
|
|
|
- sizeof(commit32->commit_v1.reserved));
|
2017-11-07 17:32:46 -05:00
|
|
|
+ count);
|
2017-10-29 01:48:53 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
static struct mdp_input_layer32 *__create_layer_list32(
|
2017-11-07 17:32:46 -05:00
|
|
|
--
|
|
|
|
cgit v1.1
|
|
|
|
|