diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2018-03-08 04:27:51 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-03-08 04:27:51 -0800 |
| commit | 07324253e2e621c2cf54105c5612e341a9f305ad (patch) | |
| tree | ad50111bdeced762fc6fad5434c84cf1287220a8 /drivers/gpu | |
| parent | b02928f9da8443672d7c4953c2a79ba445fb3e7a (diff) | |
| parent | 6252123a99088896c420a6b1721239210cba81af (diff) | |
Merge "DRM: SDE: Fix potential buffer overflow in SDE encoder"
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/msm/sde/sde_encoder.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/drivers/gpu/drm/msm/sde/sde_encoder.c b/drivers/gpu/drm/msm/sde/sde_encoder.c index cb8b349e72c7..6e4de62c6957 100644 --- a/drivers/gpu/drm/msm/sde/sde_encoder.c +++ b/drivers/gpu/drm/msm/sde/sde_encoder.c @@ -43,6 +43,8 @@ /* timeout in frames waiting for frame done */ #define SDE_ENCODER_FRAME_DONE_TIMEOUT 60 +#define MISR_BUFF_SIZE 256 + /* * Two to anticipate panels that can do cmd/vid dynamic switching * plan is to create all possible physical encoder types, and switch between @@ -1046,16 +1048,18 @@ static ssize_t _sde_encoder_misr_set(struct file *file, struct sde_encoder_virt *sde_enc; struct drm_encoder *drm_enc; int i = 0; - char buf[10]; + char buf[MISR_BUFF_SIZE + 1]; + size_t buff_copy; u32 enable, frame_count; drm_enc = file->private_data; sde_enc = to_sde_encoder_virt(drm_enc); - if (copy_from_user(buf, user_buf, count)) - return -EFAULT; + buff_copy = min_t(size_t, MISR_BUFF_SIZE, count); + if (copy_from_user(buf, user_buf, buff_copy)) + return -EINVAL; - buf[count] = 0; /* end of string */ + buf[buff_copy] = 0; /* end of string */ if (sscanf(buf, "%u %u", &enable, &frame_count) != 2) return -EFAULT; |