diff options
| author | Benet Clark <benetc@codeaurora.org> | 2015-10-01 17:32:46 -0700 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-23 20:46:22 -0700 |
| commit | e7bfd98d5e55bafd36f7f4f20de50cd22d14dbc8 (patch) | |
| tree | 68480675f6ecc77cf93ec7f306985c62d49fdb13 | |
| parent | 600868b0d9ea68816b95e05c51002560e12c9671 (diff) | |
msm: mdss: Clear allocated atomic commit kernel memory during copy
Use kzalloc instead of kmalloc to avoid junk data in the allocated
memory for the layer list and scale data.
Change-Id: I4af206d9894027e940d85b733ce4107dd9c14008
Signed-off-by: Benet Clark <benetc@codeaurora.org>
| -rw-r--r-- | drivers/video/fbdev/msm/mdss_fb.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/video/fbdev/msm/mdss_fb.c b/drivers/video/fbdev/msm/mdss_fb.c index 79021678fa9d..eb3962041af5 100644 --- a/drivers/video/fbdev/msm/mdss_fb.c +++ b/drivers/video/fbdev/msm/mdss_fb.c @@ -4062,7 +4062,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, goto err; } else if (layer_count) { buffer_size = sizeof(struct mdp_input_layer) * layer_count; - layer_list = kmalloc(buffer_size, GFP_KERNEL); + layer_list = kzalloc(buffer_size, GFP_KERNEL); if (!layer_list) { pr_err("unable to allocate memory for layers\n"); ret = -ENOMEM; @@ -4079,6 +4079,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, for (i = 0; i < layer_count; i++) { layer = &layer_list[i]; + scale = NULL; if (!(layer->flags & MDP_LAYER_PP)) { layer->pp_info = NULL; @@ -4096,7 +4097,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, continue; } - scale = kmalloc(sizeof(struct mdp_scale_data), + scale = kzalloc(sizeof(struct mdp_scale_data), GFP_KERNEL); if (!scale) { pr_err("unable to allocate memory for overlays\n"); @@ -4110,6 +4111,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, pr_err("layer list copy from user failed, scale = %p\n", layer->scale); kfree(scale); + scale = NULL; ret = -EFAULT; goto err; } @@ -4140,6 +4142,7 @@ static int mdss_fb_atomic_commit_ioctl(struct fb_info *info, err: for (i--; i >= 0; i--) { kfree(layer_list[i].scale); + layer_list[i].scale = NULL; mdss_mdp_free_layer_pp_info(&layer_list[i]); } kfree(layer_list); |