DivestOS/Patches/Linux_CVEs/CVE-2016-10286/ANY/0001.patch

51 lines
2.0 KiB
Diff
Raw Normal View History

From 5d30a3d0dc04916ddfb972bfc52f8e636642f999 Mon Sep 17 00:00:00 2001
From: Veera Sundaram Sankaran <veeras@codeaurora.org>
Date: Fri, 11 Nov 2016 12:01:34 -0800
Subject: msm: mdss: avoid removing wrong multirect on validate failures
During atomic commit - validate failures, the newly allocated
pipes and pipes taken from the destroy list are cleaned up.
Currently pipe ndx is checked which can lead to cleaning up
the already in use multirect instead of the rect allocated
in the current validate. Add checks to include checking based
on multirect to avoid such cases.
Change-Id: I7f8fb6630314cdc523490e28d90dd3776bdfeada
Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
---
drivers/video/fbdev/msm/mdss_mdp_layer.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/video/fbdev/msm/mdss_mdp_layer.c b/drivers/video/fbdev/msm/mdss_mdp_layer.c
index 20fcc26..036e4e3 100644
--- a/drivers/video/fbdev/msm/mdss_mdp_layer.c
+++ b/drivers/video/fbdev/msm/mdss_mdp_layer.c
@@ -2470,16 +2470,20 @@ validate_exit:
mutex_lock(&mdp5_data->list_lock);
list_for_each_entry_safe(pipe, tmp, &mdp5_data->pipes_used, list) {
if (IS_ERR_VALUE(ret)) {
- if ((pipe->ndx & rec_release_ndx[0]) ||
- (pipe->ndx & rec_release_ndx[1])) {
+ if (((pipe->ndx & rec_release_ndx[0]) &&
+ (pipe->multirect.num == 0)) ||
+ ((pipe->ndx & rec_release_ndx[1]) &&
+ (pipe->multirect.num == 1))) {
mdss_mdp_smp_unreserve(pipe);
pipe->params_changed = 0;
pipe->dirty = true;
if (!list_empty(&pipe->list))
list_del_init(&pipe->list);
mdss_mdp_pipe_destroy(pipe);
- } else if ((pipe->ndx & rec_destroy_ndx[0]) ||
- (pipe->ndx & rec_destroy_ndx[1])) {
+ } else if (((pipe->ndx & rec_destroy_ndx[0]) &&
+ (pipe->multirect.num == 0)) ||
+ ((pipe->ndx & rec_destroy_ndx[1]) &&
+ (pipe->multirect.num == 1))) {
/*
* cleanup/destroy list pipes should move back
* to destroy list. Next/current kickoff cycle
--
cgit v1.1