diff options
| author | Carl Vanderlip <carlv@codeaurora.org> | 2013-10-23 18:36:01 -0700 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-23 20:23:40 -0700 |
| commit | ba68b06806c32965dc4eb2bac0eca55d36388243 (patch) | |
| tree | 640407f49d86170bb6142ebf13e6dcb6ee54678e | |
| parent | e7be929aba5fb2bff7928f2805bdcccd2b0915fd (diff) | |
msm: mdss: Sanitize post processing inputs
Sanitize the inputs to histogram, assertive display, and calibration buffer
so that invalid values cannot be used as feature configuration.
CRs-Fixed: 516710
Change-Id: Ifb585174b1baadbac628f53fe67f3c3b3ae61a54
Signed-off-by: Carl Vanderlip <carlv@codeaurora.org>
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_hwio.h | 2 | ||||
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_mdp_pp.c | 29 |
2 files changed, 29 insertions, 2 deletions
diff --git a/drivers/video/fbdev/msm/mdss_mdp_hwio.h b/drivers/video/fbdev/msm/mdss_mdp_hwio.h index 302ad57c80d7..9c36c74cdc51 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_hwio.h +++ b/drivers/video/fbdev/msm/mdss_mdp_hwio.h @@ -379,6 +379,8 @@ enum mdss_mdp_writeback_index { #define MDSS_MDP_REG_WB_CSC_BASE 0x260 #define MDSS_MDP_REG_WB_DST_ADDR_SW_STATUS 0x2B0 +#define MDSS_MDP_MAX_AD_AL 65535 +#define MDSS_MDP_MAX_AD_STR 255 #define MDSS_MDP_REG_AD_BYPASS 0x000 #define MDSS_MDP_REG_AD_CTRL_0 0x004 diff --git a/drivers/video/fbdev/msm/mdss_mdp_pp.c b/drivers/video/fbdev/msm/mdss_mdp_pp.c index b35bc692589a..522f307d9055 100644 --- a/drivers/video/fbdev/msm/mdss_mdp_pp.c +++ b/drivers/video/fbdev/msm/mdss_mdp_pp.c @@ -2857,6 +2857,7 @@ exit: return ret; } +#define MDSS_MAX_HIST_BIN_SIZE 16777215 int mdss_mdp_hist_start(struct mdp_histogram_start_req *req) { u32 done_shift_bit; @@ -2865,9 +2866,13 @@ int mdss_mdp_hist_start(struct mdp_histogram_start_req *req) int i, ret = 0; u32 disp_num, dspp_num = 0; u32 mixer_cnt, mixer_id[MDSS_MDP_INTF_MAX_LAYERMIXER]; + u32 frame_size; struct mdss_mdp_pipe *pipe; struct mdss_data_type *mdata = mdss_mdp_get_mdata(); + if (!mdss_is_ready()) + return -EPROBE_DEFER; + if ((PP_BLOCK(req->block) < MDP_LOGICAL_BLOCK_DISP_0) || (PP_BLOCK(req->block) >= MDP_BLOCK_MAX)) return -EINVAL; @@ -2887,6 +2892,16 @@ int mdss_mdp_hist_start(struct mdp_histogram_start_req *req) ret = -EPERM; goto hist_exit; } + + frame_size = (mdata->ctl_off[mixer_id[0]].width * + mdata->ctl_off[mixer_id[0]].height); + if (!frame_size || + ((MDSS_MAX_HIST_BIN_SIZE / frame_size) < req->frame_cnt)) { + pr_err("%s, too many frames for given display size, %d", + __func__, req->frame_cnt); + ret = -EINVAL; + goto hist_exit; + } mdss_mdp_clk_ctrl(MDP_BLOCK_POWER_ON, false); if (PP_LOCAT(req->block) == MDSS_PP_SSPP_CFG) { @@ -3698,6 +3713,11 @@ int mdss_mdp_ad_input(struct msm_fb_data_type *mfd, ret = -EINVAL; goto error; } + if (input->in.amb_light > MDSS_MDP_MAX_AD_AL) { + pr_warn("invalid input ambient light"); + ret = -EINVAL; + goto error; + } ad->ad_data_mode = MDSS_AD_INPUT_AMBIENT; pr_debug("ambient = %d", input->in.amb_light); ad->ad_data = input->in.amb_light; @@ -3712,6 +3732,11 @@ int mdss_mdp_ad_input(struct msm_fb_data_type *mfd, ret = -EINVAL; goto error; } + if (input->in.strength > MDSS_MDP_MAX_AD_STR) { + pr_warn("invalid input strength"); + ret = -EINVAL; + goto error; + } ad->ad_data_mode = MDSS_AD_INPUT_STRENGTH; pr_debug("strength = %d", input->in.strength); ad->ad_data = input->in.strength; @@ -4591,8 +4616,8 @@ int mdss_mdp_calib_config_buffer(struct mdp_calib_config_buffer *cfg, return ret; } - if (cfg->size == 0) { - pr_err("Invalid buffer size\n"); + if (cfg->size == 0 || cfg->size > PAGE_SIZE) { + pr_err("Invalid buffer size %d\n", cfg->size); return ret; } |