DivestOS/Patches/Linux_CVEs/CVE-2016-6692/ANY/0001.patch
2017-11-07 17:32:46 -05:00

59 lines
1.8 KiB
Diff

From 0f0e7047d39f9fb3a1a7f389918ff79cdb4a50b3 Mon Sep 17 00:00:00 2001
From: Ping Li <pingli@codeaurora.org>
Date: Tue, 19 Apr 2016 18:52:10 -0700
Subject: msm: mdss: Properly set the PP feature cfg_payload in layers
Set the PP feature cfg_payload properly to avoid invalid pointer
cases.
CRs-Fixed: 1004933
Change-Id: I44314b49a6ebb5dedfdedfcddd88c12eabd1f125
Signed-off-by: Ping Li <pingli@codeaurora.org>
---
drivers/video/msm/mdss/mdss_mdp_pp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/video/msm/mdss/mdss_mdp_pp.c b/drivers/video/msm/mdss/mdss_mdp_pp.c
index 06ba5b1..0ed13ed0 100644
--- a/drivers/video/msm/mdss/mdss_mdp_pp.c
+++ b/drivers/video/msm/mdss/mdss_mdp_pp.c
@@ -7162,6 +7162,8 @@ int mdss_mdp_copy_layer_pp_info(struct mdp_input_layer *layer)
pr_err("Failed to copy IGC payload, ret = %d\n", ret);
goto exit_pp_info;
}
+ } else {
+ pp_info->igc_cfg.cfg_payload = NULL;
}
if (ops & MDP_OVERLAY_PP_HIST_LUT_CFG) {
ret = pp_copy_layer_hist_lut_payload(pp_info);
@@ -7170,6 +7172,8 @@ int mdss_mdp_copy_layer_pp_info(struct mdp_input_layer *layer)
ret);
goto exit_igc;
}
+ } else {
+ pp_info->hist_lut_cfg.cfg_payload = NULL;
}
if (ops & MDP_OVERLAY_PP_PA_V2_CFG) {
ret = pp_copy_layer_pa_payload(pp_info);
@@ -7177,6 +7181,8 @@ int mdss_mdp_copy_layer_pp_info(struct mdp_input_layer *layer)
pr_err("Failed to copy PA payload, ret = %d\n", ret);
goto exit_hist_lut;
}
+ } else {
+ pp_info->pa_v2_cfg_data.cfg_payload = NULL;
}
if (ops & MDP_OVERLAY_PP_PCC_CFG) {
ret = pp_copy_layer_pcc_payload(pp_info);
@@ -7184,6 +7190,8 @@ int mdss_mdp_copy_layer_pp_info(struct mdp_input_layer *layer)
pr_err("Failed to copy PCC payload, ret = %d\n", ret);
goto exit_pa;
}
+ } else {
+ pp_info->pcc_cfg_data.cfg_payload = NULL;
}
layer->pp_info = pp_info;
--
cgit v1.1